Skip to main content

Create a Bridge

Reviewed on · View on GitHub

You can create a bridge between two Numspot resources: two VPC (Virtual Private Cloud) so that they communicate with each other, or one VPC and the managed services of the space so that the VM (Virtual Machine) of the VPC reaches all the managed services at once.

Creation is asynchronous: the API returns a 202 Accepted code and the bridge object with an empty routes array. The bridge is ready to be routed once its routes array is populated — see Read the bridges.

Permissions​

info

This action requires the following IAM (Identity and Access Management) permission:

  • connectivity.bridge.create

Configuration required for the bridge to work​

You must configure your VPC to allow traffic to and from its bridge. This includes configuring the route table, and updating the rules of the security groups.

Route table configuration​

In the route table associated with the subnets of your VPC, create one route for each entry of the bridge's routes array:

  • the ipRange of the entry as the destination;
  • the gatewayId of the entry as the target — in the POST /compute/spaces/{spaceId}/routeTables/{id}/routes command, this value is passed in the vpcPeeringId parameter.
warning

Wait until the bridge's routes array is populated before creating the routes.

Security group configuration associated with the VM of your VPC​

Add the following rules:

  • one or more rules allowing outbound traffic to the connected resource;
  • one or more rules allowing inbound traffic from the connected resource, if required.

Your bridge is configured, and the connected resources can communicate over a private connection.

API​

The POST /connectivity/spaces/{spaceId}/bridges command creates the bridge. Both ends are described by a left and a right object, each carrying an id and a type — compute for a VPC, managedservice for the managed services of the space.

Case 1 — bridge between two VPC​

{
  "left": {
    "id": "vpc-12345678",
    "type": "compute"
  },
  "right": {
    "id": "vpc-87654321",
    "type": "compute"
  }
}

Both VPC must belong to the same space and their CIDR blocks must not overlap.

Case 2 — bridge between a VPC and the managed services of the space​

{
  "left": {
    "id": "vpc-12345678",
    "type": "compute"
  },
  "right": {
    "id": "0194f0c4-8452-77d1-aaaf-516a9731ce9e",
    "type": "managedservice"
  }
}
info

In the managedservice case, the right.id is the identifier of the space (spaceId), not the identifier of a service such as a Kubernetes cluster. The bridge connects the VPC to all the managed services of that space, which must expose their services privately (visibility: INTERNAL).

Example request: Creating a Bridge

Was this page helpful?