Stable ingress IPs

[benesch]

Overview

Host customer regions at a stable ingress IP (or set of ingress IPs), so that customers can install egress policies in their VPCs/firewalls that target outbound traffic to Materialize.

Details

Materialize today hosts each customer region at a unique stable hostname. For example, the aws/us-east-1 region of my staging account is hosted at:

887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud

Each customer region gets a unique such hostname. However, today, the IPs that the hostname resolves to is not stable and may change at any moment.

For example, here are the current set of IPs for the production sandbox:

$ dig 887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud

; <<>> DiG 9.10.6 <<>> 887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57593
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud. IN A

;; ANSWER SECTION:
887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud. 51 IN A 54.81.196.51
887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud. 51 IN A 35.168.173.83
887ktyp0m5ns54opulvy5wchz.lb.us-east-1.aws.staging.materialize.cloud. 51 IN A 44.193.142.95

Today these IPs are automatically assigned by AWS to the ingress layer's NLB. With static ingress IPs, we'd instead manually allocate these IPs from a CIDR block under our control, and then publish that CIDR in our documentation/console/SQL interface.

Alternatives

• Inbound PrivateLink (https://github.com/MaterializeInc/cloud/pull/9242)

[benesch]

cc @jubrad @pH14 @jubrad