Skip to main content

Access VeloDB Cloud from Your VPC on Azure

Before you begin, read Access VeloDB Cloud from your VPC for the connection direction, ownership model, and network-control scope. This procedure applies to software as a service (SaaS) warehouses and uses Azure Private Link to create a private endpoint in your virtual network (VNet).

Make sure that you can create private endpoints, select a subnet, configure private Domain Name System (DNS), and manage the Azure subscription and resource group that contain the client applications.

For encrypted connections, newly created warehouses must run VeloDB Core 26.1.3 or later. For an existing warehouse, upgrade to 26.1.3 or later, then submit a support ticket to request TLS enablement before following the private DNS steps below. See TLS availability.

  1. Log in to the VeloDB Cloud console. In the upper-left corner, select the warehouse that you want to use, then click Connect in the left navigation pane. Select Private Endpoint > Access VeloDB from Your VPC, and then click Set up Connection.

  2. Click Set up one or more endpoints to open Azure Private Link and create a private endpoint.

  3. On the Basics tab, verify that the Azure region matches the warehouse region, complete the form, and click Next: Resource.

    Azure private endpoint Basics tab

    ParameterCategoryDescription
    SubscriptionProject detailsAzure subscription to use for the private endpoint.
    Resource groupProject detailsResource group for the private endpoint. Create one if none is suitable.
    NameInstance detailsPrivate endpoint instance name.
    Network Interface NameInstance detailsAuto-generated from the instance name. You can edit it.
    RegionInstance detailsMust match the warehouse region.

  4. On the Resource tab, choose Connect to an Azure resource by resource ID or alias, paste the Service Alias from the VeloDB Cloud endpoint service information panel, and click Next: Virtual Network.

    Azure private endpoint Resource tab

  5. On the Virtual Network tab, select the VNet and subnet that your client applications can reach, and click Next: DNS.

    Azure private endpoint Virtual Network tab

  6. On the DNS tab, configure private DNS for the endpoint. A DNS record is required for private connectivity. On the Tags tab, add tags as needed, review the configuration, and click Create.

    Azure private endpoint DNS tab

    Azure private endpoint Tags tab

    Azure private endpoint review and create

  7. Wait for the Azure private endpoint status to change from Created to OK. The Private Link connection is ready only after the endpoint reaches OK.

    Azure private endpoint deployment status

    Azure private endpoint resource status

  8. In Azure, open the private endpoint overview page and copy its name. Open the associated network interface and copy the private IP address.

  9. Return to VeloDB Cloud. If the Set up Connection dialog is closed, open Connect > Private Endpoint > Access VeloDB from Your VPC, and then click Set up Connection. Under Endpoint Information, enter the Endpoint Name and Endpoint Private IP. Optionally enter a Description, and then click Save.

  10. Refresh the page, then open Connect > Private Endpoint > Access VeloDB from Your VPC. Locate the row by its Endpoint Name, and verify the Endpoint Private IP.

  11. In the endpoint row, select the connection option for your client, and then copy the connection details from the dialog.

  12. Configure private DNS for encrypted connections.

    Note:

    If Transport Layer Security (TLS) is Required for MySQL CLI or JDBC, or if the Stream Load endpoint uses HTTPS, configure private DNS before connecting. Otherwise, skip this step. MySQL-protocol TLS is supported in version 26.0.5 and later in the 26.0.x release series, and version 26.1.2 and later in the 26.1.x release series.

    The server certificate is issued for the VeloDB Cloud domain shown in the endpoint information, not for the Azure-generated endpoint name. Connecting directly to the Azure endpoint name causes TLS certificate validation to fail because the domain names do not match. Configure Azure Private DNS to map the VeloDB Cloud domain to the endpoint IP address.

    1. On the Azure home page, open Private DNS zones. On the Basics tab, select your resource group and complete the other required fields. In Name, enter the DNS suffix of the VeloDB Cloud domain. On the Virtual Network Links tab, add the VNet that contains the private endpoint. Then click Create to create the private DNS zone.

    Azure Private DNS zone configuration

    Azure private DNS zone for the VeloDB Cloud domain

    Azure virtual network link for the private DNS zone

    1. After creating the private DNS zone, select Record sets under DNS Management to add a record. In Name, enter the prefix that, together with the private DNS zone name, forms the complete VeloDB Cloud domain. Select A as the record type, and enter the endpoint private IP address in IP address.

    Azure private DNS A record for the VeloDB Cloud endpoint

  13. Configure your client with the copied connection details.

After the endpoint is ready, use Connection Methods to connect an application.

See also​

On This Page