Preparing Required Resources
Overview
Before creating a Kafka instance, ensure the availability of resources, including a virtual private cloud (VPC), subnet, security group, and security group rules. Each Kafka instance is deployed in a VPC and bound to a specific subnet and security group. In this way, Kafka provides an isolated virtual network environment and security protection policies that you can easily configure and manage.
To access a Kafka instance over a public network, prepare an elastic IP address (EIP) in advance.
Required Resources
Table 1 lists the resources required by a Kafka instance.
Resource |
Requirement |
Operations |
---|---|---|
VPC and subnet |
Different Kafka instances can use the same or different VPCs and subnets based on site requirements. Note the following when creating a VPC and a subnet:
|
For details about how to create a VPC and subnet, see the Virtual Private Cloud User Guide. |
Security group |
Different Kafka instances can use the same or different security groups.
To use Kafka instances, add the security group rules described in Table 2. Other rules can be added based on site requirements.
NOTE:
After a security group is created, its default inbound rule allows communication among ECSs within the security group and its default outbound rule allows all outbound traffic. In this case, you can access a Kafka instance within a VPC, and do not need to add rules according to Table 2. |
For details about how to create a security group and configure security group rules, see the Virtual Private Cloud User Guide. |
EIP |
Note the following when creating EIPs:
|
For details about how to create an EIP, see "Assigning an EIP" in Elastic IP User Guide. |
Direction |
Protocol |
Port |
Source |
Description |
---|---|---|---|---|
Inbound |
TCP |
9094 |
0.0.0.0/0 |
Access a Kafka instance through the public network (without SSL encryption). |
Inbound |
TCP |
9092 |
0.0.0.0/0 |
Access a Kafka instance within a VPC (without SSL encryption). |
Inbound |
TCP |
9095 |
0.0.0.0/0 |
Access a Kafka instance through the public network (with SSL encryption). |
Inbound |
TCP |
9093 |
0.0.0.0/0 |
Access a Kafka instance within a VPC (with SSL encryption). |
Inbound |
TCP |
9999 |
0.0.0.0/0 |
Access Kafka Manager. |
Inbound |
TCP |
9011 |
198.19.128.0/17 |
Access a Kafka instance across VPCs using a VPC endpoint (with or without SSL). |
Inbound |
TCP |
9011 |
0.0.0.0/0 |
Access a Kafka instance using DNAT (with or without SSL). |
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot