Traffic and connecting

A network carries private traffic between Instances. This page describes which kinds of traffic are possible and how Instances connect to each other. To learn how Instances get their addresses, see Addressing.

gVPC is in preview, and the networking.datumapis.com/v1alpha API can change.

What traffic a network carries

The following table describes which kinds of traffic are possible:

Traffic	Available	Details
Between Instances on the same network in the same location	Yes	Instances use their private IPv6 addresses. Any Instance can connect to any port on another Instance in the same network and location.
Between Instances on the same network in different locations	Yes	A network spans locations, and Instances can connect to each other privately across locations using their private IPv6 addresses.
Between different networks	No	Networks are isolated from each other.
To or from other addresses through an Instance	No	A network only delivers a packet addressed to an Instance’s own address, and only accepts a packet from an Instance’s own address. An Instance can’t route traffic for other addresses, so a router or VPN appliance needs an overlay, such as VXLAN or a UDP tunnel, between Instances.
Inbound from the internet	Through Datum’s ALB	Instance addresses aren’t reachable from the internet directly. Public HTTP and HTTPS traffic reaches Instances through Datum’s Application Load Balancer. Raw TCP and UDP exposure is a preview limitation.
Outbound to the internet	Yes	Instances can reach internet destinations, including services that have only IPv4 addresses.
Lookups by name	Not in the preview	Private DNS names for Instances are on the roadmap. Use IPv6 addresses in the preview.
Firewall filtering	Not in the preview	Firewall rules to filter traffic between Instances on a network are on the roadmap.

The workload API accepts a networkPolicy field on each network interface, but the field has no effect. Don’t rely on it to restrict traffic. To limit who can reach a service, check credentials in your app, or put services that must stay apart on different networks. Firewall rules for networks are on the roadmap.

Connect to other Instances

To connect from one Instance to another on the same network, use the peer’s private IPv6 address. Keep the following points in mind:

Make your app listen on IPv6 (::). An app that listens only on 0.0.0.0 accepts IPv4 connections only, and Instances don’t have IPv4 addresses.
In a URL, put an IPv6 address in square brackets, such as http://[fd20:4a3b:91c2:1::1:0:2]:8080/.
Private DNS names aren’t available in the preview. To tell an app about its peers, pass their addresses in environment variables or a ConfigMap.

What’s next

To serve a workload publicly through Datum’s ALB, see Compute and ALB.
To review what networks can’t do, see Limitations and roadmap.

Introduction

Explore

What traffic a network carries

Connect to other Instances

What’s next

​What traffic a network carries

​Connect to other Instances

​What’s next

What traffic a network carries

Connect to other Instances

What’s next