Private connectivity for Astra Streaming
By default, Astra Streaming shared clusters and Streaming Capacity Units use secure connections over the public internet.
With Streaming Capacity Units, you have the option to connect your Astra Streaming clusters to a private link service for inbound connections or to a private endpoint for outbound connections.
Private connection requirements
-
Private connections are only available for Streaming Capacity Units. This option isn’t available for shared clusters.
-
Your private link service or private endpoint must exist in the same cloud provider and region as your Astra Streaming cluster.
If you want to use private connections for multiple clusters or tenants, you must prepare at least one private link service or private endpoint in each applicable cloud provider and region.
-
Astra Streaming supports AWS Private Link, Microsoft Azure Private Link, and Google Cloud Private Service Connect.
Enable private connections
To use a private link service or private endpoint for Astra Streaming, do the following:
-
Get the name of the Astra Streaming clusters where you want to enable private connectivity.
In the Astra Portal, click Streaming, and then find cluster names in the Tenants list.
-
Get your cloud provider resource identifier:
-
AWS Private Link: AWS account numbers
-
Microsoft Azure Private Link: Azure subscription IDs
-
Google Cloud Private Service Connect: GCP project IDs
-
-
Contact DataStax Support to request private connectivity for Astra Streaming.
Private connections for inbound traffic
Astra Streaming supports private inbound traffic flowing from your private endpoint to Astra Streaming. Inbound traffic includes Apache Pulsar™, Apache Kafka®, and RabbitMQ messaging traffic, as well as Prometheus metrics traffic.
You create a connection to the DataStax private link service, and then DataStax routes traffic to your Astra Streaming Streaming Capacity Units.
If you have multiple tenants, they can have different VPCs. Each VPC will have the same private FQDN with different VNETs. The traffic on separate private end point connections is isolated until it reaches the DataStax load balancer.
The private link service pattern is the same across cloud providers, but the hostname depends on your Astra Streaming cluster’s cloud provider and region:
| Service | Endpoint pattern |
|---|---|
Pulsar messaging |
|
Kafka messaging |
|
RabbitMQ messaging |
|
Prometheus metrics |
|
Private connections for outbound traffic
On a case-by-case basis, Astra Streaming can support private outbound traffic flowing from a Astra Streaming private endpoint to your private link service.
DataStax opens a port on the tenant’s firewall to allow connectors and functions running in a dedicated namespace on an Astra Streaming cluster to connect to your private network. Each tenant has its own firewall.
