Create private instance on Cloud Foundry

1
votes

I'm currently deploying on cloud foundry, Now I have a frontend server and a backend server.
Both deployed as micro services with the Cloud Foundry nodejs build pack.

I would like to hide the backend server from the outside world, that only my frontend server can access it. How do I do that? If I remove the route to the backend server the server is hidden from the outside but then I do not know how to access it from my frontend.

I'm new to Cloud Foundry maybe there is an easy way.

Thanks

Andreas

Thanks for the information so far.

I do however not understand how I could now hide my backend instance from being accessed from the outside, but allow for access of the frontrontend?

Basically what roule would I need to set in my space in order to allow only port 80 to be accessed of my frontend instance (lets say the frontend ip is 168.192.0.5).

could you make an example?

3
ibm-cloudcloud-foundryswisscomdev
You're looking for a service discovery solution. Googling "Cloud Foundry service discovery" I get: docs.pivotal.io/spring-cloud-services/service-registry. So if you're using Pivotal Cloud Foundry, you can use that service which is based on Eureka, from Netflix's OSS toolkit. If not, there are many ways to roll your own service discovery solution (note each app instance knows its external IP and port via environment variables), but I don't know of any OSS out-of-the-box solutions. - Amit Kumar Gupta

3 Answers

0
votes

If you are using OSS Cloud Foundry, you can put the backend services into their own space, and then set the security group rules for that space so that they will not respond to outside IP addresses: https://docs.pivotal.io/pivotalcf/adminguide/app-sec-groups.html

If you are using Pivotal Cloud Foundry, you can use Spring Cloud Service Discovery, as Amit said.

0
votes

What about using "cf push myjavaapp --no-route"? The no-route option tell Bluemix that your backend is not a web application.

0
votes

Another solution to hide the back-end microservice from the public is to use containers (also available on Bluemix, based on Docker, see https://www.ng.bluemix.net/docs/containers/container_gettingstarted.html). Containers have a private IP by default and can access other containers in the same space. You can assign the front-end microservice a public IP using e.g. following command 

cf ic ip bind {public_ip} {container_name}

but don't assign a public address to your back-end microservices.

(A few weeks ago I've created a simple example for a microservice in a container, you can find the code at https://hub.jazz.net/project/matthiashub/bluemix-unistuttgart-container/overview I admit that this was done in Java and not in nodejs but I think you get the idea.)