Before deciding to dive into VPC, you should be aware of some of the difficulties in that move.
SSH to private subnet
The nodes in the private subnet are not internet addressable. That obviously means you can’t SSH into them without already being in the VPC network.
There are two options for this:
SSH into a node on the public subnet, then SSH into a private node, or
Set up a VPN in order to access all the nodes by their private addresses. We decided to deploy a VPN for ease of use.
Elastic IPs for public addressability
Even if you launch a node in a public subnet, it will not get a public IP or hostname like EC2.
The only way to make it publicly addressable is to assign an elastic IP to the node. Elastic IPs are free, of course, but you are limited to 5 per VPC, so plan accordingly.
VPC to VPC communication is non-trivial
If you’re attempting to have one VPC communicate with nodes in another VPC, get ready to buckle up because its a bumpy ride.
The reasoning behind why you would want to do such a thing and how it can be done will be covered in a future blog post, but general awareness that this is difficult should be known ahead of time.
SSH to private subnet
The nodes in the private subnet are not internet addressable. That obviously means you can’t SSH into them without already being in the VPC network.
There are two options for this:
SSH into a node on the public subnet, then SSH into a private node, or
Set up a VPN in order to access all the nodes by their private addresses. We decided to deploy a VPN for ease of use.
Elastic IPs for public addressability
Even if you launch a node in a public subnet, it will not get a public IP or hostname like EC2.
The only way to make it publicly addressable is to assign an elastic IP to the node. Elastic IPs are free, of course, but you are limited to 5 per VPC, so plan accordingly.
VPC to VPC communication is non-trivial
If you’re attempting to have one VPC communicate with nodes in another VPC, get ready to buckle up because its a bumpy ride.
The reasoning behind why you would want to do such a thing and how it can be done will be covered in a future blog post, but general awareness that this is difficult should be known ahead of time.
Comments