Using an ELB Proxy to Access OBS

Scenarios

If the IP address planning or other constraints prevent you from configuring routes to OBS private IP addresses or Direct Connect IP addresses in your on-premises IDC, you can use an ELB proxy to enable the IDC to access OBS resources through the private IP addresses within a VPC.

Solution Architecture

Figure 1 Using an ELB Proxy to access OBS from an IDC

Resource and Cost Planning

Resources listed in the following table must be deployed in the same region. CN North-Beijing4 is used as an example.

Operation Process

Making Preparations

Make the following preparations before performing any operations:

• Create a VPC if none exists. For details, see Creating a VPC with a Subnet. The VPC example-vpc deployed in CN North-Beijing4 is used as an example.
• Establish a Direct Connect connection between your on-premises IDC and the Huawei Cloud VPC. For details, see Direct Connect Best Practices. The Direct Connect example-dc deployed in CN North-Beijing4 is used as an example.
• Create an OBS bucket if none exists. For details, see Creating a Bucket. The OBS bucket example-bucket-a deployed in CN North-Beijing4 is used as an example.

Step 1: Create a VPC Endpoint and Configure a VPC Endpoint Policy

1. Go to the VPC Endpoints page.
2. Click Buy VPC Endpoint in the upper right corner.
3. On the Buy VPC Endpoint page, configure the parameters. The following table only lists the parameters that are critical in this practice. Retain the default settings for other parameters. For details, see Buying a VPC Endpoint.

   Parameter	Example Value	Description
   Region	CN North-Beijing4	The region where the VPC endpoint is located. This region must be the same as that of the VPC and OBS bucket.
   Billing Mode	Pay-per-use	The billing mode of the VPC endpoint. VPC endpoints can be used or deleted at any time.
   Service Category	Find a service by name	Select Find a service by name.
   VPC Endpoint Service Name	-	Enter the name of the VPC endpoint service to be accessed in the VPC Endpoint Service Name text box and click Verify. Submit a service ticket to obtain the service name. When submitting the service ticket, provide the OBS bucket name to technical support. Then, enter the obtained service name in the VPC Endpoint Service Name text box and click Verify.
   VPC	example-vpc	Select the VPC that connects to Direct Connect. The VPC example-vpc deployed in CN North-Beijing4 is used as an example. It is connected to the Direct Connect example-dc.
   Policy	-	Configure a VPC endpoint policy based on service requirements. For details, see Configuring Access Control with Both VPC Endpoint Policies and OBS Bucket Policies.

4. Click Next in the lower right corner.
5. Confirm the endpoint configuration and click Submit.

Step 2: Create a Dedicated Load Balancer and Add Listeners

Create a dedicated load balancer.

1. Go to the Buy Elastic Load Balancer page.
2. Configure the parameters based on Table 2. The following table only lists the parameters that are critical in this practice. Retain the default settings for other parameters. For details, see Creating a Dedicated Load Balancer.
   

   Table 2 Basic parameters for configuring a load balancer

   Parameter	Example Value	Description
   Type	Dedicated load balancer	Select Dedicated load balancer. Dedicated load balancers work well for scenarios with heavy-traffic and high-concurrency workloads, such as large websites, cloud native applications, IoV, and multi-AZ disaster recovery applications. For details about the differences between instance types, see Differences Between Dedicated and Shared Load Balancers.
   Billing Mode	Pay-per-use	Select a billing mode. Yearly/Monthly: prepaid billing mode. You pay in advance for a subscription term, and in exchange, you get a discounted rate. Pay-per-use: postpaid billing mode. You pay as you go and pay for what you use. The load balancer usage is calculated by the second but billed every hour.
   Billing Mode	Pay-per-use	Pay-per-use: postpaid billing mode. You pay as you go and pay for what you use. The load balancer usage is calculated by the second but billed every hour.
   Region	CN North-Beijing4	Select the region where the VPC and OBS are located. CN North-Beijing4 is used as an example.
   AZ	AZ1 AZ2	An AZ is a physical region where resources have independent power supply and networks. AZs are physically isolated but interconnected through an internal network. You are advised to select multiple AZs for higher service availability. For details about AZ planning, see AZ. WARNING: If you change the AZs of a load balancer, the load balancer may fail to route requests for several seconds. Plan the AZs in advance.
   Name	example-elb	The load balancer name. The name: Can contain 1 to 64 characters. Can only include letters, digits, underscores (_), hyphens (-), and periods (.).
   Enterprise Project	default	When creating a load balancer, you can add it to an enabled enterprise project. An enterprise project can be used to centrally manage cloud resources and users by project. For details about creating and managing enterprise projects, see the Enterprise Management User Guide.

3. Select specifications for the dedicated load balancer based on Table 3.
   

   Table 3 Load balancer specifications

   Parameter	Example Value	Description
   Specification Type	Elastic	Select a specification type. Elastic: This type works well for fluctuating traffic, and you will be billed for how many LCUs you use. Fixed: This type is suitable for stable traffic, and you will be billed for the LCUs that are calculated based on each fixed specification you select. For details, see Specifications of Dedicated Load Balancers.
   	Network load balancing	Select only Network load balancing. It supports TCP, TLS, and UDP. This option works well for heavy-traffic and high-concurrency workloads at Layer 4, such as file transfer, instant messaging, and online video applications.

4. Complete the network configurations based on Table 4.
   

   Table 4 Network parameters for configuring a load balancer

   Parameter	Example Value	Description
   Network Type	Private IPv4 network	Select Private IPv4 network. The load balancer routes IPv4 requests from clients to backend servers in a VPC. If you want the load balancer to route IPv4 requests from the Internet, bind an EIP to the load balancer.
   VPC	example-vpc	Select the VPC that connects to Direct Connect. Once a dedicated load balancer is created, its VPC cannot be changed. Plan the VPC as required.
   Frontend Subnet	-	The frontend subnet from which a private IP address will be assigned to the dedicated load balancer to communicate with resources over the private network. This practice has no special requirements for this parameter, so set it based on your network plan.
   IPv4 Address	Automatically assign IP address	Select Automatically assign IP address. The system assigns an IPv4 address to the load balancer.
   Backend Subnet	Subnet of the load balancer	Select Subnet of the load balancer. This parameter specifies the backend subnet from which IP addresses will be assigned to the dedicated load balancer to forward requests to and perform health checks on backend servers. Plan subnets for dedicated load balancers to reserve enough IP addresses to support future service growth.
   IP as a Backend	Select this option.	Enable IP as a Backend. After this option is enabled, you can associate the backend servers with the load balancer by using their IP addresses. To add backend servers that are not in the VPC of the load balancer, see Adding Backend Servers in a Different VPC from a Load Balancer. If you enable this option, more IP addresses in the backend subnet need to be reserved for the load balancer to communicate with backend servers. Ensure that the selected subnet has sufficient IP addresses.

5. Configure an EIP for the load balancer to enable it to route IPv4 requests over the Internet. For details, see Table 5.

   Table 5 Selecting an EIP for the load balancer

   Parameter	Example Value	Description
   EIP	Not required	The EIP that will be bound to the load balancer for receiving and forwarding IPv4 requests over the Internet Not required: You can bind an EIP to the load balancer later. Auto assign: A new EIP will be assigned to the load balancer. Use existing: Select an existing EIP.

6. Enter the number of load balancers you want to buy. In this example, enter 1.
7. Click Buy Now.

Create two listeners.

You need to create two listeners that listen on ports 80 and 443 respectively. The following describes how to create a listener that listens on port 80. After completing this, create a listener that listens on port 443 in the same way.

1. Go to the load balancer list page.
2. Click the name of the created load balancer, example-elb.
3. On the Listeners tab, click Add Listener. Configure the parameters based on Table 6. The following table only lists the parameters that are critical in this practice. Retain the default settings for other parameters. For details, see Adding a Listener.
   

   Table 6 Parameters for configuring a TCP listener

   Parameter	Example Value	Description
   Frontend Protocol	TCP	The protocol that will be used by the load balancer to receive requests from clients. Select TCP.
   Listening Port	Single port	The port or port ranges that will be used by the load balancer to receive requests from clients. Select Single port. The listener listens only on the specified port.
   	80	The number of the port that will be used by the load balancer to receive requests from clients
   Name (Optional)	example-listener	The name of the listener
   Access Control	All IP addresses	Specifies which IP addresses are allowed or denied to access the listener. For details, see Access Control Policies.

4. Click Next: Configure Request Routing Policy.
5. Click Create new to create a backend server group and configure parameters based on Table 7.
   

   Table 7 Parameters for configuring a backend server group

   Parameter	Example Value	Description
   Backend Server Group Name	example-server-group	The name of the backend server group
   Backend Server Group Type	Hybrid	The type of the backend server group Hybrid: You can add cloud servers and supplementary network interfaces as backend servers or add IP addresses as backend servers when IP as a Backend is enabled. When you create a hybrid backend server group, you must specify a VPC and associate the backend server group with a load balancer in this VPC.
   Forwarding Mode	Load balancing	The forwarding mode to distribute traffic. Select Load balancing. You can add one or more backend servers to the backend server group.
   Backend Protocol	TCP	The protocol that backend servers in the backend server group use to receive requests from the listeners. Select TCP.
   IP Address Version	IPv4	The IP address version of backend servers that can be added to the backend server group. Select IPv4.
   Load Balancing Algorithm	Weighted round robin	The algorithm used by the load balancer. If you select Weighted round robin, requests are routed to different servers based on their weights. Backend servers with higher weights receive proportionately more requests, whereas equal-weighted servers receive the same number of requests. For more information about load balancing algorithms, see Load Balancing Algorithms.

6. Click Next: Add Backend Server.
7. Click the IP as Backend Servers tab and click Add IP as Backend Server. Configure the parameters based on Table 8.
   

   Table 8 Parameters for adding IP addresses as backend servers

   Parameter	Example Value	Description
   IP Address	100.125.224.5	The private IP address of the OBS bucket. You can obtain it in either of the following ways: Submit a service ticket and provide the OBS bucket name to technical support. Log in to the ECS in the same region as the OBS bucket and run the following command: ping BucketName.obs.myhuaweicloud.com For example, log in to the ECS in CN North-Beijing4 and run the ping example-bucket-a.obs.myhuaweicloud.com command. The private IP address of the OBS bucket is displayed in the output.
   Backend Port	80	The port used by the backend server to process requests
   Weight	-	The weight for the backend server to receive requests. The higher the weight, the more requests the backend server receives. The weight of a backend server ranges from 0 to 100. New requests will not be routed to the backend server whose weight is 0. Set this parameter as required and do not set it to 0.

8. Click OK.
9. Click Next: Confirm.
10. Confirm the configurations and click Submit.

Step 3: Bind a User-Defined Domain Name to the Bucket on OBS Console

1. In the navigation pane, choose Domain Name Mgmt.
   Figure 2 Domain name management page
   

2. Click Configure User Domain Name, enter the domain name to be configured, and click OK. The domain name suffix can contain 2 to 6 uppercase or lowercase letters, for example, .com and .cn.

   Configuring a user-defined domain name

   

Step 4: Configure Domain Name Resolution on the DNS Console

The CNAME record set configuration varies depending on DNS providers. In this document, DNS provided by Huawei Cloud is used as an example. For details about how to configure CNAME records with other DNS providers, see Configuring a CNAME Record.

1. Go to the load balancer list page.
2. Obtain the service address of the load balancer, as shown in Figure 3.
   Figure 3 Obtaining the service address of the load balancer
   

3. Click the target user-defined domain name in the Domain Name column.
4. Configure parameters by referring to Table 9. Keep the default settings for the parameters that are not listed in the following table.

   Table 9 Parameters

   Parameter	Example Value	Description
   Type	CNAME – Map one domain to another	Type of the record set, which should be the CNAME type.
   Name	*	The prefix of the domain name to be resolved For example, if the domain name is example.com, its prefix can be: www: used for website resolution. The domain name to be resolved is www.example.com. Left blank: used for website resolution. The domain name to be resolved is example.com. To use an at sign (@), leave this parameter blank. abc: The domain name to be resolved is abc.example.com, a subdomain of example.com. mail: The domain name to be resolved is mail.example.com. *: The domain name to be resolved is *.example.com, any subdomain of example.com.
   Value	IP address obtained from 2	Enter the obtained IP address of the load balancer.

5. Click OK.
6. Verify that the added CNAME record set is in effect.
   Open the Windows command line interface and run the following command. If the output is the bucket domain name, the CNAME record set is in effect.

   nslookup -qt=cname User-defined domain name bound to the bucket

Step 5: Construct an OBS Request

For a private bucket, use the user-defined domain name to calculate the signature or initialize the SDK client to access resources in the bucket.

• If you call the OBS API directly to access resources in the bucket, replace the bucket name in the CanonicalizedResource field with the user-defined domain name when calculating the API signature. For details, see the OBS Signature Mechanism.
• If you use OBS SDKs to access resources in the bucket, set endpoint to the endpoint of the user-defined domain name and configure related parameters when initializing the SDK client. Table 10 lists the parameters related to the user-defined domain name.

  Table 10 Parameters related to the user-defined domain name

  Language	Java	Python	C	Go	BrowserJS	Android	iOS	PHP	Node.js
  Parameters to be set	cname	is_cname	useCname host_name	cname	is_cname	cname	OBSDomainModeCustom	is_cname	is_cname