AWS Reference Network ArchitecturePDF version

Additional VPC scenarios

Learn more about the additional VPC scenarios that show how VPC can be configured between your workload environment and Cloudera Control Plane.

Scenario 1: VPC endpoint in your egress VPC with no HTTP proxy
This scenario has the VPC endpoints in your egress VPC, allowing the VPC endpoints to be shared by multiple VPCs in your network. In this setup, VPC endpoints receive IPs from egress VPC.
  • DNS overrides where DNS is a per-VPC view:
    • Deploying a VPC endpoint with private DNS option enabled will automatically install the DNS overrides in the egress VPC, but this does not solve the overrides for the workload environment VPC.
    • DNS override zones and records can be deployed in each workload environment VPC, or a single set of DNS override zones and records are deployed and the zones are associated with each workload environment VPC.
  • DNS overrides where DNS is a regional or global view:
    • The DNS override will have a regional or global impact to resolution of the Cloudera hostnames, clients in the region/globally will receive these VPC endpoints.
Scenario 2: VPC endpoint in your egress VPC, HTTP proxy
Similar to scenario 1, except you have egress traffic flowing through an HTTP proxy in the egress VPC. In this setup, VPC endpoints receive IPs from egress VPC.
  • DNS overrides:
    • Deploying a VPC endpoint with private DNS option enabled will automatically install the DNS overrides in the egress VPC. If the egress proxy is performing the DNS lookup for the destination service, this approach should be sufficient.
    • Transparent proxy or egress firewall policy configurations may require the original destination IP to match the DNS resolution. If this is the case, the override zones/records/VPC associations can be deployed as described in scenario 1.
Scenario 3: VPC endpoint in your workload environment VPC, HTTP proxy
VPC endpoints deployed in your workload environment network. In this setup, VPC endpoints receive IPs from egress VPC.
  • DNS overrides where DNS is a per-VPC view:
    • Deploying a VPC endpoint with “private DNS” option enabled will automatically install the DNS overrides in the egress VPC. This is recommended.
  • DNS overrides where DNS is a regional or global view:
    • The overrides will impact resolution for clients elsewhere in the region and globally.
    • Traffic to these hostnames from outside this VPC will attempt to use these VPC endpoints, which may not be a desired configuration
  • HTTP forward proxy or non-transparent proxy
    • Workload environment will be configured to use an HTTP proxy profile.
    • The no_proxy configuration of the profile must include the hostnames of the APIs reachable through VPC endpoint. HTTP requests for destinations in the no_proxy list will not be forwarded to the proxy, local DNS and therefore the VPC endpoints will be used for that traffic