So here's my situation:
We are a young startup scaling up and we decided to give Mesosphere DCOS Community edition a try. The community edition deploys a stack of Masters, Slaves and LB's over AWS CloudFormation using a template. (our template)
(editing the template to use an existing VPC causes an error: Template validation error: Template format error:
Unresolved resource dependencies [<target_vpc_id>] in the Resources block of the template)
The community edition has two limits (I can't seem to find where these limits are documented):
- it cannot be deployed over an existing VPC.
- it creates a single-AZ VPC for each new deployment.
Now, we'd like to enable this new cluster to speak to the RDS. Obviously, we run into problems:
- The RDS instance cannot be deployed over a single-AZ VPC
- The RDS VPC can be peered to the DCOS VPC, but since RDS instances only have an endpoint (no static IP), that has to be resolved from the other VPC to a local address and not the global IP.
What would be the best way to approach this situation?
So, I added a private-only RDS instance and it's endpoint now correctly resolves to its local IP address from anywhere. Now, my DCOS cluster is located in a VPC which is
10.0.0.0/16 lets call this
VPC-A, and my RDS instance is in
VPC-B, which is
Now to enable communications between the two networks, I added a VPC peering between
Next, I set up the routes in
Security group setting for the target RDS Instance in
Inbound All Traffic All ports CIDR: 10.0.0.0/16
Security group settings for source instances in
Outbound: All Traffic All Ports CIDR: 0.0.0.0/0
But then again, I still cannot make any connections from
I've also checked the security group settings for all instances belonging to
VPC-A: All outbound traffic is allowed.
VPC-B: All incoming traffic from
10.0.0.0/16 is allowed on port
What's going on here?