VPC with Apps, Droplets and Managed Databases | Voters

VPC with Apps, Droplets and Managed Databases

Frederik Löffert

Being able to integrate Apps into a VPC together with droplets and managed databases, would allow secure / private access to them. Maybe even kubernetes could be integrated.

November 10, 2020

meteo-domani

Essential ❤

David G

Bikram Gupta
The problem is latency. And especially the connection handshake between App Platform and Managed Databases.
It is not a good idea to connect the App Platform to the database over the public network.
We migrated to App Platform and had to remove it because it was very slow.
I attach two images. The same query in App Platform and a Droplet with VPC
App Platform --> 23.14ms
Droplet With VPC --> 9.60ms

Bikram Gupta

Frederik Löffert Kristian David G Simo Elalj stonerinski  Lukas Bohler Max Carlson Jan David Langr Komninos Chatzipapas and all, Thank you for your valuable feedback. 
As the Product Manager for App Platform, I can confirm that we are actively investigating this feature. In the meantime, I'd like to share some interim workarounds for enhancing security.
1) For managed databases: App Platform supports a trusted source capability. While traffic still travels over the public network, this feature allows you to conveniently enforce access control on the database side.
For more information, please refer to our documentation on managing databases:
https://docs.digitalocean.com/products/app-platform/how-to/manage-databases/#add-a-database-to-an-app-using-the-control-panel
2) For connecting to Droplets and DOKS from your apps: You can leverage dedicated egress IPs. This allows you to enforce access control on the receiving end (e.g., Droplet), effectively creating a firewalled connection.
For details on implementing this, please see our guide on adding IP addresses:
https://docs.digitalocean.com/products/app-platform/how-to/add-ip-address/#add-dedicated-egress-ips
We would love to hear if these workarounds solve your problem or if you have any further questions or concerns.

Whitney Jutzin

Merged in a post:

Apps + VPC?

Kristian

Allow developers to add apps to a VPC network would be great!

July 18, 2024

David G

Is there any update about this?

Simo Elalj

This is a dealbreaker to migrate to app platform

stonerinski

I can only agree with the others, this is extremely important and THE pain point that makes us consider moving away from app platform again and again. Are there any concrete plans to realise this?

Lukas Bohler

Is there any ETA on this? We would love to switch to App platform. This is still a blocker for us.

Max Carlson

We really, really want the ability to do this - for performance and security... Apps are great, but it feels like they're still missing a lot of key features.

David G

Performance difference between App platform and droplet.
We have migrated to Droplet and all performance issues have been resolved.
The same source code. The only difference is that the connection to the database is made through VPC...
It is very important that the App platform supports VPC

Bikram Gupta

David G Thank you for your feedback. I wanted to bring your attention to some recent performance improvements we've implemented for App Platform.
We've published a blog post detailing these enhancements, which you can find here:
https://www.digitalocean.com/blog/introducing-new-runtime-performance-improvements-app-platform
If you're open to discussing, we'd greatly appreciate your insights. As a token of our gratitude for your time and feedback on performance, we'd be happy to offer you account credits. Please reply if you're interested.

Kris Ciccarello

Bikram Gupta I think what he is referring to, and what I have noticed, is that the latency between app platform runtime to a managed database is very poor and has significant variance. While true that trusted sources is a band-aid for the security issues (but not a great solution it is still routable...), the performance issues of not having the VPC connection should not be overlooked.

It is ESPECIALLY an issue with managed Redis, as introducing 30+ms just to route to a high performance cache inside the same datacenter region is a hard pill to swallow.

→