Skip to content

Commit 1783cfc

Browse files
v-jaswelv-jaswel
committed
Update per cachai review.
1 parent 4b11302 commit 1783cfc

File tree

4 files changed

+76
-80
lines changed

4 files changed

+76
-80
lines changed

‎articles/container-apps/TOC.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -347,8 +347,8 @@
347347
items:
348348
- name: Overview
349349
href: networking.md
350-
- name: Configuration
351-
href: networking-configuration.md
350+
- name: Environment-level networking
351+
href: environment-level-networking.md
352352
- name: Ingress
353353
items:
354354
- name: Overview
@@ -388,7 +388,7 @@
388388
items:
389389
- name: Use rule-based routing
390390
href: rule-based-routing.md
391-
- name: Configure a custom domain
391+
- name: Use a custom domain with rule-based routing
392392
href: rule-based-routing-custom-domain.md
393393
- name: Securing a custom VNET with an NSG
394394
href: firewall-integration.md

‎articles/container-apps/custom-virtual-networks.md

Lines changed: 26 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.topic: conceptual
8-
ms.date: 11/21/2023
8+
ms.date: 05/01/2025
99
ms.author: cshoe
1010
---
1111

@@ -123,35 +123,41 @@ If you're using the CLI, the parameter to define the subnet resource ID is `infr
123123

124124
If you're using the Azure CLI with a Consumption only environment and the [platformReservedCidr](vnet-custom-internal.md#networking-parameters) range is defined, both subnets must not overlap with the IP range defined in `platformReservedCidr`.
125125

126-
## <a name="private-endpoint"></a>Private endpoint (preview)
126+
## NAT gateway integration
127+
128+
You can use NAT Gateway to simplify outbound connectivity for your outbound internet traffic in your virtual network in a workload profiles environment.
127129

128-
Azure private endpoint enables clients located in your private network to securely connect to your Azure Container Apps environment through Azure Private Link. A private link connection eliminates exposure to the public internet. Private endpoints use a private IP address in your Azure virtual network address space.
130+
When you configure a NAT Gateway on your subnet, the NAT Gateway provides a static public IP address for your environment. All outbound traffic from your container app is routed through the NAT Gateway's static public IP address.
129131

130-
This feature is supported for both Consumption and Dedicated plans in workload profile environments.
132+
## Managed resources
131133

132-
#### Tutorials
133-
- To learn more about how to configure private endpoints in Azure Container Apps, see the [Use a private endpoint with an Azure Container Apps environment](how-to-use-private-endpoint.md) tutorial.
134-
- Private link connectivity with Azure Front Door is supported for Azure Container Apps. Refer to [create a private link with Azure Front Door](how-to-integrate-with-azure-front-door.md) for more information.
134+
When you deploy an internal or an external environment into your own network, a new resource group is created in the Azure subscription where your environment is hosted. This resource group contains infrastructure components managed by the Azure Container Apps platform. Don't modify the services in this group or the resource group itself.
135135

136-
#### Considerations
137-
- Private endpoints on Azure Container Apps only support inbound HTTP traffic. TCP traffic isn't supported.
138-
- To use a private endpoint with a custom domain and an *Apex domain* as the *Hostname record type*, you must configure a private DNS zone with the same name as your public DNS. In the record set, configure your private endpoint's private IP address instead of the container app environment's IP address. When you configure your custom domain with CNAME, the setup is unchanged. For more information, see [Set up custom domain with existing certificate](custom-domains-certificates.md).
139-
- Your private endpoint's VNet can be separate from the VNet integrated with your container app.
140-
- You can add a private endpoint to both new and existing workload profile environments.
136+
# [Workload profiles environment](#tab/workload-profiles-env)
141137

142-
In order to connect to your container apps through a private endpoint, you must configure a private DNS zone.
138+
The name of the resource group created in the Azure subscription where your environment is hosted is prefixed with `ME_` by default, and the resource group name *can* be customized as you create your container app environment.
143139

144-
| Service | subresource | Private DNS zone name |
145-
|--|--|--|
146-
| Azure Container Apps (Microsoft.App/ManagedEnvironments) | managedEnvironment | privatelink.{regionName}.azurecontainerapps.io |
140+
For external environments, the resource group contains a public IP address used specifically for inbound connectivity to your external environment and a load balancer. For internal environments, the resource group only contains a [Load Balancer](https://azure.microsoft.com/pricing/details/load-balancer/).
147141

148-
You can also [use private endpoints with a private connection to Azure Front Door](how-to-integrate-with-azure-front-door.md) in place of Application Gateway. This feature is in preview.
142+
In addition to the standard [Azure Container Apps billing](./billing.md), you're billed for:
149143

150-
## NAT gateway integration
144+
- One standard static [public IP](https://azure.microsoft.com/pricing/details/ip-addresses/) for egress if using an internal or external environment, plus one standard static [public IP](https://azure.microsoft.com/pricing/details/ip-addresses/) for ingress if using an external environment. If you need more public IPs for egress due to SNAT issues, [open a support ticket to request an override](https://azure.microsoft.com/support/create-ticket/).
151145

152-
You can use NAT Gateway to simplify outbound connectivity for your outbound internet traffic in your virtual network in a workload profiles environment.
146+
- One standard [load balancer](https://azure.microsoft.com/pricing/details/load-balancer/).
153147

154-
When you configure a NAT Gateway on your subnet, the NAT Gateway provides a static public IP address for your environment. All outbound traffic from your container app is routed through the NAT Gateway's static public IP address.
148+
- The cost of data processed (in GBs) includes both ingress and egress for management operations.
149+
150+
# [Consumption only environment](#tab/consumption-only-env)
151+
152+
The name of the resource group created in the Azure subscription where your environment is hosted is prefixed with `MC_` by default, and the resource group name *can't* be customized when you create a container app. The resource group contains public IP addresses used specifically for outbound connectivity from your environment and a load balancer.
153+
154+
In addition to the standard [Azure Container Apps billing](./billing.md), you're billed for:
155+
156+
- One standard static [public IP](https://azure.microsoft.com/pricing/details/ip-addresses/) for egress. If you need more IPs for egress due to Source Network Address Translation (SNAT) issues, [open a support ticket to request an override](https://azure.microsoft.com/support/create-ticket/).
157+
158+
- Two standard [load balancers](https://azure.microsoft.com/pricing/details/load-balancer/) if using an internal environment, or one standard [load balancer](https://azure.microsoft.com/pricing/details/load-balancer/) if using an external environment. Each load balancer has fewer than six rules. The cost of data processed (in GBs) includes both ingress and egress for management operations.
159+
160+
---
155161

156162
## Next steps
157163

‎articles/container-apps/networking-configuration.md renamed to ‎articles/container-apps/environment-level-networking.md

Lines changed: 5 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,17 @@
11
---
2-
title: Networking configuration in Azure Container Apps environment
3-
description: Learn how to configure networking in Azure Container Apps.
2+
title: Networking configuration in an Azure Container Apps environment
3+
description: Learn how to configure networking in an Azure Container Apps environment.
44
services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
77
ms.topic: conceptual
8-
ms.date: 04/11/2025
8+
ms.date: 05/01/2025
99
ms.author: cshoe
1010
---
1111

12-
# Networking configuration in Azure Container Apps environment
12+
# Networking in an Azure Container Apps environment
1313

14-
Azure Container Apps run in the context of an environment, with its own virtual network (VNet). This VNet creates a secure boundary around your Azure Container Apps [environment](environment.md). This article tells you how to configure your VNet.
15-
16-
## Managed resources
17-
18-
When you deploy an internal or an external environment into your own network, a new resource group is created in the Azure subscription where your environment is hosted. This resource group contains infrastructure components managed by the Azure Container Apps platform. Don't modify the services in this group or the resource group itself.
19-
20-
# [Workload profiles environment](#tab/workload-profiles-env)
21-
22-
The name of the resource group created in the Azure subscription where your environment is hosted is prefixed with `ME_` by default, and the resource group name *can* be customized as you create your container app environment.
23-
24-
For external environments, the resource group contains a public IP address used specifically for inbound connectivity to your external environment and a load balancer. For internal environments, the resource group only contains a [Load Balancer](https://azure.microsoft.com/pricing/details/load-balancer/).
25-
26-
In addition to the standard [Azure Container Apps billing](./billing.md), you're billed for:
27-
28-
- One standard static [public IP](https://azure.microsoft.com/pricing/details/ip-addresses/) for egress if using an internal or external environment, plus one standard static [public IP](https://azure.microsoft.com/pricing/details/ip-addresses/) for ingress if using an external environment. If you need more public IPs for egress due to SNAT issues, [open a support ticket to request an override](https://azure.microsoft.com/support/create-ticket/).
29-
30-
- One standard [load balancer](https://azure.microsoft.com/pricing/details/load-balancer/).
31-
32-
- The cost of data processed (in GBs) includes both ingress and egress for management operations.
33-
34-
# [Consumption only environment](#tab/consumption-only-env)
35-
36-
The name of the resource group created in the Azure subscription where your environment is hosted is prefixed with `MC_` by default, and the resource group name *can't* be customized when you create a container app. The resource group contains public IP addresses used specifically for outbound connectivity from your environment and a load balancer.
37-
38-
In addition to the standard [Azure Container Apps billing](./billing.md), you're billed for:
39-
40-
- One standard static [public IP](https://azure.microsoft.com/pricing/details/ip-addresses/) for egress. If you need more IPs for egress due to Source Network Address Translation (SNAT) issues, [open a support ticket to request an override](https://azure.microsoft.com/support/create-ticket/).
41-
42-
- Two standard [load balancers](https://azure.microsoft.com/pricing/details/load-balancer/) if using an internal environment, or one standard [load balancer](https://azure.microsoft.com/pricing/details/load-balancer/) if using an external environment. Each load balancer has fewer than six rules. The cost of data processed (in GBs) includes both ingress and egress for management operations.
43-
44-
---
14+
Azure Container Apps run in the context of an environment, with its own virtual network (VNet). This VNet creates a secure boundary around your Azure Container Apps [environment](environment.md). This article tells you how to configure networking in your environment.
4515

4616
## <a name="peer-to-peer-encryption"></a> Peer-to-peer encryption in the Azure Container Apps environment
4717

‎articles/container-apps/networking.md

Lines changed: 42 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ description: Learn about virtual networks in Azure Container Apps.
44
services: container-apps
55
author: craigshoemaker
66
ms.service: azure-container-apps
7-
ms.topic: conceptual
8-
ms.date: 04/11/2025
7+
ms.topic: conceptual
8+
ms.date: 05/01/2025
99
ms.author: cshoe
1010
---
1111

@@ -40,11 +40,6 @@ Use an existing VNet when you need Azure networking features like:
4040
- Control over outbound traffic from your container app
4141
- Access to resources behind private endpoints in your virtual network
4242

43-
Use a generated VNet when you do not need these features. Generated VNets only support a limited subset of networking capabilities such as:
44-
45-
- Ingress IP restrictions
46-
- Container app level ingress controls
47-
4843
If you use an existing VNet, you need to provide a subnet that is dedicated exclusively to the Container App environment you deploy. This subnet isn't available to other services. For more information see [Virtual network configuration](custom-virtual-networks.md).
4944

5045
## Accessibility level
@@ -69,33 +64,46 @@ In order to create private endpoints on your Azure Container App environment, pu
6964

7065
Azure networking policies are supported with the public network access flag.
7166

72-
### Ingress configuration
67+
## <a name="private-endpoint"></a>Private endpoint (preview)
7368

74-
Under the [ingress](azure-resource-manager-api-spec.md#propertiesconfiguration) section, you can configure the following settings:
69+
Azure private endpoint enables clients located in your private network to securely connect to your Azure Container Apps environment through Azure Private Link. A private link connection eliminates exposure to the public internet. Private endpoints use a private IP address in your Azure virtual network address space.
7570

76-
- Ingress: You can enable or disable ingress for your container app.
71+
This feature is supported for both Consumption and Dedicated plans in workload profile environments.
7772

78-
- Ingress traffic: You can accept traffic to your container app from anywhere, or you can limit it to traffic from within the same Container Apps environment.
73+
#### Tutorials
74+
- To learn more about how to configure private endpoints in Azure Container Apps, see the [Use a private endpoint with an Azure Container Apps environment](how-to-use-private-endpoint.md) tutorial.
75+
- Private link connectivity with Azure Front Door is supported for Azure Container Apps. Refer to [create a private link with Azure Front Door](how-to-integrate-with-azure-front-door.md) for more information.
7976

80-
- Traffic split rules: You can define traffic splitting rules between different revisions of your application. For more information, see [Traffic splitting](traffic-splitting.md).
77+
#### Considerations
78+
- To use a private endpoint, you must disable [public network access](#public-network-access). By default, public network access is enabled, which means private endpoints are disabled.
79+
- Private endpoints only support inbound HTTP traffic. TCP traffic isn't supported.
80+
- To use a private endpoint with a custom domain and an *Apex domain* as the *Hostname record type*, you must configure a private DNS zone with the same name as your public DNS. In the record set, configure your private endpoint's private IP address instead of the container app environment's IP address. When you configure your custom domain with CNAME, the setup is unchanged. For more information, see [Set up custom domain with existing certificate](custom-domains-certificates.md).
81+
- Your private endpoint's VNet can be separate from the VNet integrated with your container app.
82+
- You can add a private endpoint to both new and existing workload profile environments.
8183

82-
For more information about different networking scenarios, see [Ingress in Azure Container Apps](ingress-overview.md).
84+
In order to connect to your container apps through a private endpoint, you must configure a private DNS zone.
8385

84-
### Environment security
86+
| Service | subresource | Private DNS zone name |
87+
|--|--|--|
88+
| Azure Container Apps (Microsoft.App/ManagedEnvironments) | managedEnvironment | privatelink.{regionName}.azurecontainerapps.io |
8589

86-
:::image type="content" source="media/networking/locked-down-network.png" alt-text="Diagram of how to fully lock down your network for Container Apps.":::
90+
You can also [use private endpoints with a private connection to Azure Front Door](how-to-integrate-with-azure-front-door.md) in place of Application Gateway. This feature is in preview.
8791

88-
You can fully secure your ingress and egress networking traffic workload profiles environment by taking the following actions:
92+
### Ingress configuration
8993

90-
- Create your internal container app environment in a workload profiles environment. For steps, refer to [Manage workload profiles with the Azure CLI](./workload-profiles-manage-cli.md#create).
94+
Under the [ingress](azure-resource-manager-api-spec.md#propertiesconfiguration) section, you can configure the following settings:
9195

92-
- Integrate your Container Apps with an [Application Gateway](./waf-app-gateway.md).
96+
- Ingress: You can enable or disable ingress for your container app.
9397

94-
- Configure UDR to route all traffic through [Azure Firewall](./user-defined-routes.md).
98+
- Ingress traffic: You can accept traffic to your container app from anywhere, or you can limit it to traffic from within the same Container Apps environment.
99+
100+
- Traffic split rules: You can define traffic splitting rules between different revisions of your application. For more information, see [Traffic splitting](traffic-splitting.md).
101+
102+
For more information about different networking scenarios, see [Ingress in Azure Container Apps](ingress-overview.md).
95103

96104
## Inbound features
97105

98-
|Feature |Learn how to |
106+
|Feature |Learn how to |
99107
|---------|---------|
100108
|[Ingress](ingress-overview.md)<br><br>[Configure ingress](ingress-how-to.md) | Control the routing of external and internal traffic to your container app. |
101109
|[IP restrictions](ip-restrictions.md) | Restrict inbound traffic to your container app by IP address. |
@@ -110,15 +118,15 @@ You can fully secure your ingress and egress networking traffic workload profile
110118

111119
## Outbound features
112120

113-
|Feature |Learn how to |
121+
|Feature |Learn how to |
114122
|---------|---------|
115123
|[Using Azure Firewall](using-azure-firewall.md) | Use Azure Firewall to control outbound traffic from your container app. |
116124
|[Securing a existing VNet with an NSG](firewall-integration.md) | Secure your container app environment's VNet with a Network Security Group (NSG). |
117125
|[NAT gateway integration](custom-virtual-networks.md#nat-gateway-integration)| Use NAT Gateway to simplify outbound internet connectivity in your virtual network in a workload profiles environment. |
118126

119127
## Tutorials
120128

121-
|Tutorial |Learn about how to |
129+
|Tutorial |Learn how to |
122130
|---------|---------|
123131
|[Use a virtual network](vnet-custom.md) | Use a virtual network. |
124132
|[Configure WAF Application Gateway](waf-app-gateway.md) | Configure a WAF application gateway. |
@@ -128,6 +136,18 @@ You can fully secure your ingress and egress networking traffic workload profile
128136
|[Use a private endpoint](how-to-use-private-endpoint.md) (preview) | Use a private endpoint to securely access your Azure Container App without exposing it to the public Internet. |
129137
|[Integrate with Azure Front Door](how-to-integrate-with-azure-front-door.md) (preview) | Connect directly from Azure Front Door to your Azure Container Apps using a private link instead of the public internet. |
130138

139+
### Environment security
140+
141+
:::image type="content" source="media/networking/locked-down-network.png" alt-text="Diagram of how to fully lock down your network for Container Apps.":::
142+
143+
You can fully secure your ingress and egress networking traffic workload profiles environment by taking the following actions:
144+
145+
- Create your internal container app environment in a workload profiles environment. For steps, refer to [Manage workload profiles with the Azure CLI](./workload-profiles-manage-cli.md#create).
146+
147+
- Integrate your Container Apps with an [Application Gateway](./waf-app-gateway.md).
148+
149+
- Configure UDR to route all traffic through [Azure Firewall](./user-defined-routes.md).
150+
131151
## HTTP edge proxy behavior
132152

133153
Azure Container Apps uses an edge HTTP proxy that terminates Transport Layer Security (TLS) and routes requests to each application.

0 commit comments

Comments
 (0)