Configuring Public Network Access for an Elasticsearch Cluster

Constraints

• Enabling public network access for a CSS cluster may incur some fees, as it will need to use EIP and bandwidth resources.
• The security mode can be enabled only for Elasticsearch 6.5.4 clusters or later and OpenSearch clusters.
• Public network access and the VPC Endpoint service share a load balancer. If you configure a whitelist for public network access, and because this whitelist is deployed to the shared load balancer, it will control not only access from the public network, but also access using private IP addresses through VPCEP. In this case, you need to add IP address 198.19.128.0/17 to the public network access whitelist to allow traffic through VPCEP.

Configuring Public Network Access

1. Log in to the CSS management console.
2. On the Create Cluster page, enable Security Mode. Set the administrator password and enable HTTPS access.
3. Select Automatically assign for Public IP Address and set related parameters.
   Figure 1 Configuring public network access
   

   Table 1 Public network access parameters

   Parameter	Description
   Bandwidth	Bandwidth for accessing Kibana with the public IP address
   Access Control	If you disable this function, all IP addresses can access the cluster through the public IP address. If you enable access control, only IP addresses in the whitelist can access the cluster through the public IP address.
   Whitelist	IP address or IP address range allowed to access a cluster. Use commas (,) to separate multiple addresses. This parameter can be configured only when Access Control is enabled.

Configuring Public Network Access for an Existing Cluster

You can configure, modify, view the public network access of, or disassociate the public IP address from a cluster.

1. Log in to the CSS management console.
2. On the Clusters page, click the name of the target cluster. On the Basic Information page that is displayed, manage the public network access configurations.
   Figure 2 Modifying public network access configurations
   
   • Configuring public network access

     If you enabled HTTPS but did not configure the public network access during security cluster creation, you can configure it on the Basic Information page after configuring the cluster.

     Click Associate next to Public IP Address, set the access bandwidth, and click OK.

     If the association fails, wait for a few minutes and try again.

   • Modifying public network access

     For a cluster for which you have configured public network access, you can click Edit next to Bandwidth to modify the bandwidth, or you can click Set next to Access Control to set the access control function and the whitelist for access.

   • Checking public network access settings

     On the Basic Information page, you can see the public IP address associated with the current cluster.

   • Disassociating a public IP address from a cluster

     To disassociate a public IP address, click Disassociate next to Public IP Address.

Accessing a Cluster Through the Public IP Address

After configuring the public IP address, you can use it to access the cluster.

curl -u username:password -k 'https://10.62.179.32:9200/_cat/indices'

where, username and password indicate the username and password of the HTTPS-enabled security-mode cluster.