Connection Options

Connectivity options for Db2® Warehouse SaaS Azure deployments.

Connecting via Public Endpoint

  1. Go to the admin console → click the engine name → open the web console
  2. In the web console, click Administration → go to the Connections tab
  3. From the Connections tab, download the SSL certificate file (e.g., DigiCertGlobalRootCA.crt), shown in the image below:
  4. Convert the certificate to PEM format by renaming it: 
    mv DigiCertGlobalRootCA.crt test.pem
  5. Use the JDBC connection string provided in the console. Replace the certificate path with your local path, highlighted in the image below:

You can use this JDBC URL to connect from any client of your choice—Java, Python, Go, Node.js, or GUI tools like DBeaver and DbVisualizer. For the following example, we use Java through DBeaver.

Example: connecting with DBeaver

  1. Open DBeaver → New Database Connection → select Db2 for LUW
  2. Select Connect by URL, and paste the JDBC URL in the format shown below: 
    
jdbc:db2://1950c4e6-62db-4a04-b878-3c75e6026162.br39b4kd0nhcc3jffbt0.databases.appdomain.cloud:30731/bludb:user=<your-username>;password=<your-password>;sslConnection=true;sslCertLocation=/path/to/test.pem;sslClientHostnameValidation=false;
  3. Click Edit Driver Settings → Driver properties and verify that the SSL properties are correctly passed
  4. Click Test Connection → Finish

Note: The sslClientHostnameValidation=false option is required when the SSL certificate's hostname does not match the public endpoint. Without this, most clients will reject the connection.

Refer to your preferred client or driver documentation for equivalent parameters in Python, Go, Node.js, etc.

Connecting via Private Peering

  1. Determine the CIDR range of the existing cluster: In the Azure portal, search for Virtual Networks, then search for the reduced dataplane ID. Click the virtual network (VNet) that matches the ID and check the Address space field. The VNet that the customer creates must not overlap with this IP range, so they need to be aware of it.

  2. Create a virtual network and peer it: In the Azure portal, search for Virtual Network, click Create virtual network, and provide a resource group, name, and region. Then provide an IP range that does not overlap with the value discovered in Address space and complete the creation. Click Peerings under the settings of the newly created virtual network, click Add, choose a name for both sides of the peering, and select the virtual network that contains the Kubernetes service (found in step 1).

  3. Create a VM to go inside the VNet: In the portal, search for Virtual Machines, select the same resource group created in step 2, and select the matching region. Under SSH public key source, create or choose a key to use for the deployment. Click Next through to the networking tab. The NIC network security group can be configured in the Advanced tab if inbound IPs should be restricted. Complete creation of the VM.

You should now be able to ssh -i <ssh key> azureuser@<IP> and connect to db2 using a driver/connection string and the private endpoint provided in the connections tab of the console.

Connecting from Cluster:


az aks command invoke   --resource-group rg-ibmbyoc-648cae8e-dataplane   --name aks-ibmbyoc-648cae8e-common   --command "kubectl -n db2common get services"
command started at 2025-06-18 15:05:30+00:00, finished at 2025-06-18 15:05:31+00:00 with exitcode=0
NAME                                                           TYPE           CLUSTER-IP   EXTERNAL-IP      PORT(S)               AGE
...
c-f35df3d4-ecf2-4fc6-85b3-7c07b7ceb749-db2u-engn-nlb-private   LoadBalancer   10.0.0.174   10.225.2.103     55000:32144/TCP       15h

From Jumpbox:


azureuser@testdelete:~$ nc -zv 10.225.2.103 55000
Connection to 10.225.2.103 55000 port [tcp/*] succeeded!

Private Link

  1. Enable private link either through the deployment of the engine, or on the console connection toggles, creating the engine with the private link enabled is probably easier to start with.

  2. (Optional if already completed) Create a virtual network: In the Azure portal, search for Virtual Network, click Create virtual network, provide a resource group, name, and region. Then specify an IP range and complete the creation.

  3. (Optional if already completed) Create a VM inside the VNet: In the Azure portal, search for Virtual Machines, select the same resource group created in step 2, and choose the same region as the VNet. Under SSH public key source, create or select a key. In the Networking tab, configure the NIC network security group under Advanced if needed. Complete the VM creation.

  4. Create a private link endpoint: From Portal, search Private Link Endpoints, click Create, make sure to select the region of the vnet you are deployed into, on the Resource page choose PrivateLinkService, find the service that was enabled for your load balancer, it will contain your formation ID. Once creation is completed you can find the host/IP from

  5. Once the endpoint is created, it will provide an IP from the private endpoint interface. When you search for the private endpoint you created, the IP is now accessible within the virtual machine. You can connect to it by running ssh -i <ssh key> azureuser@<IP>.


azureuser@testdelete:~$ nc -zv 124.0.1.6 55000
Connection to 124.0.1.6 55000 port [tcp/*] succeeded!