Skip to main content

Connect S3 to other products

warning

Configuring new connections for S3 connectivity with other products via a global router is temporarily unavailable.

For your information

You can connect S3 to other products over a private network only in specific pools: in pools ru-3 and ru-7 — with servers in Russia, and in pool uz-2 — with servers in Uzbekistan.

To connect S3 with other products over a private network, a global router is used.

  1. If you do not have a global router yet, create a router.
  2. Connect the other product's subnet to the global router.
  3. Create an interconnect subnet for S3 connectivity with the global router.
  4. Add a static route to S3 on servers in the other product.
  5. Configure requests to the private S3 endpoint on servers in the other product.

1. Create a global router

  1. In the control panel, in the top menu, click Products and select Global Router.
  2. Click Create router. Each account has a limit of five global routers.
  3. Enter the router name.
  4. Click Create.
  5. If the router was created with the status ERROR or is stuck in one of the statuses, create a ticket.

2. Connect the other product's subnet to the global router

You can connect a new network to the router or an existing network if it is not already connected to any of the account's global routers.

  1. In the Control panel, from the top menu, click Products and select Global Router.

  2. Open the router page → Networks tab.

  3. Click Create network.

  4. Enter a network name. It will only be used in the control panel.

  5. Select the Servers and hardware service.

  6. Select the location of the network.

  7. Select or enter a VLAN.

  8. If you want to create a network to an internal segment (Q-in-Q), specify its tag — a number from 2 to 4094. If a network already exists for the VLAN, you must specify the Q-in-Q segment of this VLAN.

  9. Enter a subnet name. It will only be used in the control panel.

  10. Enter the CIDR — the IP address and mask of the private subnet. You can enter a new subnet or an existing private server subnet if it has not yet been added to any of the global routers in the account. The subnet must meet the following conditions:

    • belong to the RFC 1918 private address range: 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16;
    • have a size of at least /29, because three addresses will be occupied by Servercore network equipment;
    • do not overlap with other subnets added to this router — there must be no identical IP addresses within subnets on the same router;
    • if a Managed Kubernetes cluster on cloud servers is connected to the global router network, the subnet must not overlap with the ranges 10.10.0.0/16, 10.96.0.0/12, 10.250.0.0/16, and 10.251.0.0/24. If a cluster on dedicated servers is connected to the network — with the ranges 10.10.0.0/16, 10.222.0.0/16, 10.250.0.0/16, 10.251.0.0/24, and 172.250.0.0/14. These subnets are used in Managed Kubernetes internal addressing, and their use may lead to conflicts in the global router network.

  11. Enter the gateway IP or leave the first address from the subnet, which is assigned by default. Do not assign this address to your devices to avoid network disruption.

  12. Enter the service IPs or leave the last addresses from the subnet, which are assigned by default. Do not assign these addresses to your devices to avoid network disruption.

  13. Click Create network.

  14. Optional: check the network topology on the global router. In the Control panel, from the top menu, click Products → Global Router → router page → Network map.

  15. If you specified a Q-in-Q tag in step 8, enable Q-in-Q on the switch port and configure the network interface of the private network specified in step 10. Learn more in the Configure Q-in-Q section of the Q-in-Q instructions.

3. Create an interconnect subnet and endpoint for S3 connectivity with the global router

  1. Submit a ticket. In the ticket, specify:

    • Global router ID, which can be found in the Control panel: in the top menu, click Products → Servercore Global Router → router page → copy the ID under the router name;
    • Desired subnet CIDR of at least /28, which will be used as an interconnect subnet from the global router to S3. The subnet must belong to the private address range according to RFC 1918: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. The subnet must not overlap with other subnets added to this router — subnets on the same router must not contain identical IP addresses;
    • Endpoint — a single private IP address to which traffic to S3 will be sent. This IP address must not be part of the selected interconnect subnet.

  2. Wait for a response from the Servercore team confirming that connectivity from S3 to the global router has been set up. The created interconnect subnet will not be displayed in the global router in the Control panel. If you need to change the addressing of the subnet or the S3 endpoint, submit a ticket.

4. Add static routes to S3

On each server you connect to S3, you need to add a static route to the S3 endpoint via the global router.

If the global router is used on the servers as the default gateway, there is no need to add routes.

  1. Connect to the server.

  2. Open the network configuration file:

    vi /etc/netplan/01-netcfg.yaml

  3. At the end of the block for the required network interface, add a route:

    routes:
      - to: <endpoint_ip_address>/32
        via: <gateway>

    Specify:

  4. Save the file.

  5. Check the settings:

    sudo netplan try

  6. Apply the changes:

    netplan apply

5. Configure requests to the private S3 endpoint on servers in the other product

By default, S3 is accessed via a public domain. If a request is sent to a private IP address, an error about a certificate mismatch will be returned in the response.

To avoid the error, map the endpoint specified in the ticket when creating a private network and endpoint in step 3 to the S3 API domain in the required pool (ru-3, ru-7, or uz-2).

Configuration depends on whether your infrastructure has its own DNS recursor.

Add A records on the recursor:

storage.selcloud.ru. IN A <endpoint_ip_address>
<s3_domain>. IN A <endpoint_ip_address>

Specify: