Virtuoso SaaS Managed Service: RDF Cluster buyer runbook

Virtuoso Universal Server
, , ,
1

For buyers of the RDF Cluster plans of Virtuoso SaaS Managed Service on AWS Marketplace (ClusStart, ClusPro, ClusBiz, ClusEnt, ClusUltra, ClusMax). Everything here is done from the buyer portal, the AWS CLI, or a SQL or SPARQL client. For a step-by-step walkthrough with screenshots, see the buyer guide.

1. What you get

A cluster is one publisher node that accepts writes and two to five subscriber nodes that serve reads. Every write to the publisher replicates to every subscriber.

Plan Subscribers Each node
Cluster Starter (ClusStart) 2 2 vCPU, 8 GB
Cluster Professional (ClusPro) 3 4 vCPU, 16 GB
Cluster Business (ClusBiz) 5 8 vCPU, 32 GB
Cluster Enterprise (ClusEnt) 5 16 vCPU, 64 GB
Cluster Enterprise Ultra (ClusUltra) 5 32 vCPU, 120 GB
Cluster Enterprise Max (ClusMax) 5 32 vCPU, 244 GB

Every plan runs Virtuoso Commercial Edition in AWS us-east-1.

2. Subscribing

  1. Subscribe to an RDF Cluster plan on the AWS Marketplace listing, then choose Set up your account. If the AWS page stalls on “redirecting to the seller”, go back to the product’s subscription page in AWS Marketplace and choose Set up your account again; the subscription itself is already in place.
  2. Complete registration: the page shows the plan you bought and region US East (N. Virginia); enter your email, then create your portal sign-in or sign in. If your AWS account has subscribed before, registration is skipped and you go straight to the portal.
  3. Your cluster starts automatically. It shows as provisioning under RDF Clusters and is running after about 10 to 20 minutes, once replication has been verified. You do not need to create it.

One subscription gives one cluster. Each subscription appears in the portal’s Subscription selector by plan name; the portal opens on your newest active one. If a cluster is terminated, you can create a new one from RDF Clusters > New RDF Cluster.

3. Endpoints and access

All restricted endpoints are closed until you add your IP ranges under Network Access on the cluster page.

Endpoint Where Access
Public SPARQL (read-only) https://<subscriber host>:8891/sparql, load-balanced across subscribers Open to everyone
Subscriber TLS SQL / ODBC / JDBC (read-only) <subscriber host>:1112, user reader Your allowlist
Publisher SPARQL (writes) and each node’s Conductor https://<management host>:9443 (publisher), :9444 and up (subscribers) Your allowlist
Publisher TLS SQL (read/write, user dba) <management host>:1112 Your allowlist, and only when Allow publisher SQL (read/write) access is ticked

The cluster page lists the exact host names. Open Public SPARQL Endpoint at the top of the page opens the public endpoint.

Network Access

  1. On the cluster page, enter your IPv4 ranges in Allowed IPv4 CIDRs, comma-separated, for example 203.0.113.45/32. 0.0.0.0/0 is not allowed. Leave the field blank to close every restricted endpoint.
  2. Tick Allow publisher SQL (read/write) access only if you need to load data remotely over SQL. It opens TLS SQL as dba on the publisher to the same ranges.
  3. Choose Update Network Access. Changes apply in seconds and do not restart any node.

Passwords

Choose Reveal Passwords on the cluster page for the dba password (publisher, full access) and the reader password (subscribers, read-only). Keep the dba password private; anyone who has it and is inside your allowlist can change the data.

TLS certificate

Every endpoint uses Virtuoso’s own self-signed certificate. Browsers show a certificate warning for the HTTPS endpoints. SQL clients connect with encryption on: Virtuoso’s isql with -E connects and prints warning CL083: self-signed certificate, which is expected. Trusted certificates are planned after launch.

Example:

isql <subscriber host>:1112 -E reader '<reader password>'

4. Loading and querying data

  • Read queries: use public SPARQL, or TLS SQL as reader. Subscribers return the same data, so any subscriber can answer.
  • Writes: go to the publisher only: publisher SPARQL (port 9443, allowlist), publisher TLS SQL as dba (opt-in), or a container shell (section 5). Writes made on a subscriber are not replicated and are lost when that subscriber is rebuilt.
  • Bulk loading: use a container shell on the publisher and Virtuoso’s bulk loader (ld_dir and rdf_loader_run), or publisher TLS SQL from your own network.
  • Replication is asynchronous: a write appears on the subscribers within seconds. The service checks every hour that a fresh write reaches every subscriber.

5. Container shell (ECS Exec)

You can open a shell inside any node with the AWS CLI v2 and the Session Manager plugin.

  1. One-time IAM setup in your AWS account. Attach this policy to the IAM user or role you use with the AWS CLI. AWS root credentials cannot assume roles.

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AssumeVirtuosoSaaSBuyerShellRoles",
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": [
        "arn:aws:iam::545314153384:role/tenant/virtuoso-*-buyer-shell",
        "arn:aws:iam::545314153384:role/virtuoso-*-buyer-shell"
      ]
    }
  ]
}

  2. On the cluster page under Container Shell Access, choose Download Script for the node you need.

  3. Run the script with bash <script>.sh. Run it as a file; do not paste it into your terminal, because its set -euo pipefail would then apply to your own shell.

The script assumes the cluster’s shell role (the role and external ID are shown on the page) and opens a shell in that node’s Virtuoso container. Inside, isql localhost:1111 dba "$DBA_PASSWORD" connects locally.

If you see AccessDenied on sts:AssumeRole, the IAM policy above is missing or out of date on your IAM user or role.

6. Stop, start and terminate

At the top right of the cluster page:

  • Stop Cluster stops every node (subscribers first, then the publisher). Storage, endpoints and backups are kept. Scheduled backups and the hourly replication check pause while it is stopped.
  • Start Cluster starts the publisher, then the subscribers, and returns the cluster to running once replication is verified (allow 10 to 20 minutes).
  • Terminate Cluster destroys every node, its storage and its endpoints. You must type the cluster ID to confirm. It cannot be undone. It does not cancel your Marketplace agreement.

Your Marketplace contract price is the same whether the cluster is running or stopped.

7. Backups and restores

  • The publisher is backed up online every 24 hours, without downtime, to storage isolated for your cluster. Backups are kept for 30 days.
  • The cluster page shows the latest backup time and size.
  • You can also take your own online backup from a publisher container shell; Copy Publisher Backup Commands on the cluster page has the commands.
  • Restores are done by OpenLink to keep replication consistent. Contact OpenLink support with the cluster ID, the recovery point you need, and confirmation that writes can be paused. OpenLink restores the publisher, rebuilds the subscribers, validates replication, and returns the cluster to service.

8. Cancelling

When your Marketplace agreement is cancelled or expires, the cluster is torn down automatically, normally within an hour:

  1. All restricted endpoints are closed.
  2. A final backup of the publisher is taken (if the cluster is running) and kept for 30 days.
  3. All nodes, storage, endpoints and credentials are removed.

Contact OpenLink support within 30 days if the cancellation was a mistake and you need that final backup.

9. Known limits

  • One region: us-east-1.
  • Asynchronous replication: subscribers can be a few seconds behind the publisher.
  • The reader account is read-only for your data. It can create tables in its own schema on the subscriber it is connected to; such tables are local to that one subscriber and are lost if it is rebuilt.
  • Self-signed TLS on every endpoint (section 3).

10. Support

Contact OpenLink support with your cluster ID (shown on the cluster page, for example clus_ca68d69d20b0) and your AWS account ID.