Manage a scale group's network and security groups

View as Markdown

You can attach or detach a scale group’s VPCs, assign or remove its public IP, and change the security groups that set the firewall rules for its nodes. Stop the scale group before you change its network. You can change the security groups while it reads Running or Scaling.

Before you begin

For VPC or public IP changes, the scale group must be stopped. Stopping removes every node, and starting it again brings back as many nodes as Minimum Node. See Resize, stop, or start a scale group. To make several network changes, stop it once and make them all before you start it.
For security group changes, the scale group is in the Running or Scaling state.
To attach a VPC, you have one in the Active state. See Create a VPC.
To attach a security group, you have one with the rules you need. See Create a security group and Add or edit rules.
Your role in the current project has the update permission for Auto Scaling.

See the scale group’s network

In MyAccount, under Compute, click Auto Scaling, click your scale group, and open its Network tab. It lists each VPC attached to the scale group with its name and CIDR, and says whether a public IP is Assigned or Not Assigned. If no VPC is attached, it says No vpc is attached. The tab is available while the scale group reads Running, Scaling, Starting, Stopping, or Stopped.

A scale group in a VPC is also listed on that VPC’s Associated Scale Groups tab.

Attach a VPC

Stop the scale group, and wait until it reads Stopped.
On the Network tab, click Attach more vpc, or Click here when no VPC is attached.
In Select VPC, pick one or more VPCs in the Active state. To make one first, click Create New VPC. When no VPC is left to attach, the list says No vpc are available to attach.
Confirm the selection. VPC attached successfully. confirms it.
Start the scale group again.

If you try to attach a VPC while the scale group reads anything other than Stopped, the portal says Vpc can only be attached in stopped state.

Detach a VPC

Before you detach the only VPC, assign the scale group a public IP. If you try before it has one, the portal says:

Assign Public IP to the scale group in order to detach this only attached vpc.

Stop the scale group, and wait until it reads Stopped.
On the Network tab, click the detach button beside the VPC’s name and CIDR.
In Confirm detach Vpc, click Detach Vpc. A message confirms the detach, where <vpc-name> is the VPC’s name and <group-name> is the scale group’s name:
```
<vpc-name> detached successfully from scale group - <group-name>
```
Start the scale group again.

Once the only VPC is detached, the scale group goes back to E2E’s default private network.

Assign or remove the public IP

You assign or remove the scale group’s public IP on the Network tab. Without a public IP, the nodes have only their private address in the VPC.

Attach a VPC before you remove the public IP. Without one, you see You would be able to deassign public IP only if vpc is attached to the scale group.

Stop the scale group, and wait until it reads Stopped.
On the Network tab, next to Public IP, click Click here. Confirm Unassign Public IP? opens when a public IP is assigned, or Confirm Assign Public IP? when none is.

Click Unassign IP or Assign IP. You will see one of these messages, where <group-name> is your scale group’s name:

Public Ip deassigned successfully from scale group - <group-name>
Public Ip assigned successfully to scale group - <group-name>

Start the scale group again.

If you try to remove the public IP while the scale group reads anything other than Stopped, the portal says Public Ip can only be deassigned in stopped state.

The Activity Timeline records each change as ATTACH_VPC, DETACH_VPC, ATTACH_PUBLIC_IP, or DETACH_PUBLIC_IP.

Change the security groups

The Security Group tab lists the security groups attached to the scale group, with their Inbound Rules and Outbound Rules. It is available while the scale group reads Running or Scaling.

To add one, click Attach Security Group and pick a security group. You attach security groups one at a time.
To remove one, click Detach on it.

A scale group always keeps at least one security group, so to replace the last one, attach the new security group first, then detach the old one. Detaching the last one is refused with Cannot detach only attached Security Group!!!

Attaching or detaching a security group changes the rules on the running nodes and on every node the scale group starts later. On the running nodes, allow about 10 minutes for the change to take effect.

Each change also needs at least one node in the scale group. With none, the change is refused with No VMs Attached.

Wait for each change to finish before you start the next. Starting one while another runs gets one of these messages:

Please Wait as Your Last Security Group is Still Getting Attached to your Scaler VMs, after an attach.
Please Wait as Your Last Security Group is Still Getting Detached from your Scaler VMs, after a detach.

A security group’s own page lists the scale groups it is attached to, on its Associated Scaler tab.

The Network and Security Group tabs now show what the scale group has attached, and the Activity Timeline records who changed it. To make these changes from a script, see the as-attach-vpc, as-detach-vpc, as-assign-public-ip, as-unassign-public-ip, as-available-sgs, as-attach-sg, and as-detach-sg operations in the API reference. If a change is refused, see Troubleshooting Auto Scaling. To see which load balancers use the scale group, see Check which load balancers use the scale group.