Skip to content

Commit 28fddda

Browse files
cebundycebundy
committed
add portal instructions for disble ingess and made other small fixes
1 parent eec7645 commit 28fddda

File tree

7 files changed

+67
-146
lines changed

7 files changed

+67
-146
lines changed

‎articles/container-apps/client-certificate-authorization.md

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,28 +5,22 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: container-apps
77
ms.topic: how-to
8-
ms.date: 03/20/2023
8+
ms.date: 03/29/2023
99
ms.author: cshoe
1010
---
1111

1212
# Configure client certificate authentication in Azure Container Apps
1313

1414
Azure Container Apps supports client certificate authentication (also known as mutual TLS or mTLS) that allows access to your container app through two-way authentication. This article shows you how to configure client certificate authorization in Azure Container Apps.
1515

16-
When client certificate are used, the TLS certificates are exchanged between the client and your container app to authenticate identity and encrypt traffic. Client certificates are often used in "zero trust" security models to authorize client access within an organization.
16+
When client certificates are used, the TLS certificates are exchanged between the client and your container app to authenticate identity and encrypt traffic. Client certificates are often used in "zero trust" security models to authorize client access within an organization.
1717

1818
For example, you may want to require a client certificate for a container app that manages sensitive data.
1919

2020
Container Apps accepts client certificates in the PKCS12 format are that issued by a trusted certificate authority (CA), or are self-signed.
2121

22-
<!--
23-
Anthony mentioned that the customer will be able to obtain a client certificate through Azure. So this will need to be added to the doc.
24-
-->
25-
2622
>[!NOTE]
2723
> Client certificate authorization is only supported in Container Apps environments that use a [custom VNET](vnet-custom.md).
28-
> Question: Are certificates available in the consumption tier? Any other limitations?
29-
> Should we include more use cases?
3024
3125
## Configure client certificate authorization
3226

@@ -36,8 +30,7 @@ The client certificate mode property available as you enable [ingress](./ingress
3630
- `accept`: The client certificate is optional. If the client certificate isn't provided, the request is still accepted.
3731
- `ignore`: The client certificate is ignored.
3832

39-
When `require` or `accept` are set, ingress passes the client certificate to the container app.
40-
33+
Ingress passes the client certificate to the container app if `require` or `accept` are set.
4134

4235
The following ARM template example configures ingress to require a client certificate for all requests to the container app.
4336

‎articles/container-apps/ingress-how-to.md

Lines changed: 42 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: container-apps
77
ms.topic: how-to
8-
ms.date: 02/12/2023
8+
ms.date: 03/28/2023
99
ms.author: cshoe
1010
ms.custom: ignite-fall-2021, event-tier1-build-2022
11+
zone_pivot_groups: arm-azure-cli-portal
1112
---
1213

1314
# Configure Ingress for your app in Azure Container Apps
@@ -16,127 +17,28 @@ This article shows you how to enable [ingress](ingress-overview.md) features for
1617

1718
## Ingress settings
1819

19-
You can set the following ingress properties:
20+
You can set the following ingress template properties:
2021

2122
| Property | Description | Values | Required |
2223
|---|---|---|---|
23-
| `allowInsecure` | Allows insecure traffic to your container app. | `false` (default), `true`<br><br>If set to `true`, HTTP requests to port 80 aren't automatically redirected to port 443 using HTTPS, allowing insecure connections.| No |
24+
| `allowInsecure` | Allows insecure traffic to your container app. When set to `true` HTTP requests to port 80 aren't automatically redirected to port 443 using HTTPS, allowing insecure connections.| `false` (default), `true` enables insecure connections| No |
2425
| `clientCertificateMode` | Client certificate mode for mTLS authentication. Ignore indicates server drops client certificate on forwarding. Accept indicates server forwards client certificate but doesn't require a client certificate. Require indicates server requires a client certificate. | `Required`, `Accept`, `Ignore` (default) | No |
25-
| `customDomains` | Custom domain bindings for Container Apps' hostnames. See [Custom domains and certificates](custom-domains-certificates.md) | Array of bindings | No |
26-
| `exposedPort` | (TCP ingress only) An port for TCP ingress. If `external` is `true`, the value must be unique in the Container Apps environment if ingress is external. | A port number from `1` to `65535`. (can't be `80` or `443`) | No |
26+
| `customDomains` | Custom domain bindings for Container Apps' hostnames. See [Custom domains and certificates](custom-domains-certificates.md) | An array of bindings | No |
27+
| `exposedPort` | (TCP ingress only) The port TCP listens on. If `external` is `true`, the value must be unique in the Container Apps environment. | A port number from `1` to `65535`. (can't be `80` or `443`) | No |
2728
| `external` | Allow ingress to your app from outside its Container Apps environment. |`true` or `false`(default) | Yes |
28-
| `ipSecurityRestrictions` | IP ingress restrictions. See [Set up IP ingress restrictions](ip-restrictions.md) | array of rules | No |
29+
| `ipSecurityRestrictions` | IP ingress restrictions. See [Set up IP ingress restrictions](ip-restrictions.md) | An array of rules | No |
2930
| `stickySessions.affinity` | Enables [session affinity](sticky-sessions.md). | `none` (default), `sticky` | No |
3031
| `targetPort` | The port your container listens to for incoming requests. | Set this value to the port number that your container uses. For HTTP ingress, your application ingress endpoint is always exposed on port `443`. | Yes |
31-
| `traffic` | Traffic weights based on revision name or labels. See [Traffic splitting](traffic-splitting.md) | array of rules | No |
32-
| `transport` | The transport protocol type. | auto (default) detects HTTP/1 or HTTP/2, `http` for HTTP/1, `http2` for HTTP/2, `tcp` for TCP. | No |
33-
34-
<!--
35-
36-
This is supposed to be the schema for ingress. We haven't changed to this yet, but it's what we're planning on.
37-
38-
https://github.com/Azure/azure-rest-api-specs/blob/4fcd6d4eb9153ff8dbbb2940d62c3789ca15e8ce/specification/app/resource-manager/Microsoft.App/stable/2022-10-01/ContainerApps.json#L703
39-
40-
"Ingress": {
41-
"description": "Container App Ingress configuration.",
42-
"type": "object",
43-
"properties": {
44-
"fqdn": {
45-
"description": "Hostname.",
46-
"type": "string",
47-
"readOnly": true
48-
},
49-
"external": {
50-
"description": "Bool indicating if app exposes an external http endpoint",
51-
"default": false,
52-
"type": "boolean"
53-
},
54-
"targetPort": {
55-
"format": "int32",
56-
"description": "Target Port in containers for traffic from ingress",
57-
"type": "integer"
58-
},
59-
"exposedPort": {
60-
"format": "int32",
61-
"description": "Exposed Port in containers for TCP traffic from ingress",
62-
"type": "integer"
63-
},
64-
"transport": {
65-
"description": "Ingress transport protocol",
66-
"enum": [
67-
"auto",
68-
"http",
69-
"http2",
70-
"tcp"
71-
],
72-
"type": "string",
73-
"x-ms-enum": {
74-
"name": "IngressTransportMethod",
75-
"modelAsString": true
76-
},
77-
"default": "auto"
78-
},
79-
"traffic": {
80-
"description": "Traffic weights for app's revisions",
81-
"type": "array",
82-
"items": {
83-
"$ref": "#/definitions/TrafficWeight"
84-
},
85-
"x-ms-identifiers": [
86-
"revisionName"
87-
]
88-
},
89-
"customDomains": {
90-
"description": "custom domain bindings for Container Apps' hostnames.",
91-
"type": "array",
92-
"items": {
93-
"$ref": "#/definitions/CustomDomain"
94-
},
95-
"x-ms-identifiers": [
96-
"name"
97-
]
98-
},
99-
"allowInsecure": {
100-
"description": "Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections",
101-
"type": "boolean",
102-
"default": false
103-
},
104-
"ipSecurityRestrictions": {
105-
"description": "Rules to restrict incoming IP address.",
106-
"type": "array",
107-
"items": {
108-
"$ref": "#/definitions/IpSecurityRestrictionRule"
109-
},
110-
"x-ms-identifiers": [
111-
"name"
112-
]
113-
},
114-
"clientCertificateMode": {
115-
"description": "Client certificate mode for mTLS authentication. Ignore indicates server drops client certificate on forwarding. Accept indicates server forwards client certificate but does not require a client certificate. Require indicates server requires a client certificate.",
116-
"enum": [
117-
"ignore",
118-
"accept",
119-
"require"
120-
],
121-
"type": "string",
122-
"x-ms-enum": {
123-
"name": "IngressClientCertificateMode",
124-
"modelAsString": true
125-
}
126-
},
127-
}
128-
},
129-
-->
32+
| `traffic` | [Traffic splitting](traffic-splitting.md) weights split between revisions. | An array of rules | No |
33+
| `transport` | The transport protocol type. | auto (default) detects HTTP/1 or HTTP/2, `http` for HTTP/1, `http2` for HTTP/2, `tcp` for TCP. | No |
13034

131-
## Enable ingress
13235

133-
<!-- >[!NOTE]
134-
> Need to think about how to present the different options for enabling ingress. Do we break the setting down to separate sections?
135-
[Anthony] I think the descriptions in the above table should suffice for now.
136-
-->
36+
## Enable ingress
13737

13838
You can configure ingress for your container app using the Azure CLI, an ARM template, or the Azure portal.
13939

40+
::: zone pivot="azure-cli"
41+
14042
# [Azure CLI](#tab/azure-cli)
14143

14244
This `az containerapp ingress enable` command enables ingress for your container app. You must specify the target port, and you can optionally set the exposed port if your transport type is `tcp`.
@@ -146,7 +48,7 @@ az containerapp ingress enable \
14648
--name <app-name> \
14749
--resource-group <resource-group> \
14850
--target-port <target-port> \
149-
--exposed-port tcp-exposed-port> \
51+
--exposed-port <tcp-exposed-port> \
15052
--transport <transport> \
15153
--type <external>
15254
--allow-insecure
@@ -156,12 +58,17 @@ az containerapp ingress enable \
15658

15759
| Option | Property | Description | Values | Required |
15860
| --- | --- | --- | --- | --- |
159-
| `--type` | external | Allow ingress to your app from outside its Container Apps environment. | `external` or `internal` | Yes |
61+
| `--type` | external | Allow ingress to your app from anywhere, or limit ingress to its internal
62+
Container Apps environment. | `external` or `internal` | Yes |
16063
|`--allow-insecure` | allowInsecure | Allow HTTP connections to your app. | | No |
16164
| `--target-port` | targetPort | The port your container listens to for incoming requests. | Set this value to the port number that your container uses. Your application ingress endpoint is always exposed on port `443`. | Yes |
16265
|`--exposed-port` | exposedPort | (TCP ingress only) An port for TCP ingress. If `external` is `true`, the value must be unique in the Container Apps environment if ingress is external. | A port number from `1` to `65535`. (can't be `80` or `443`) | No |
16366
|`--transport` | transport | The transport protocol type. | auto (default) detects HTTP/1 or HTTP/2, `http` for HTTP/1, `http2` for HTTP/2, `tcp` for TCP. | No |
16467

68+
::: zone-end
69+
70+
::: zone pivot="azure-portal"
71+
16572
# [Portal](#tab/portal)
16673

16774
Enable ingress for your container app by using the portal.
@@ -186,6 +93,9 @@ You can configure ingress when you create your container app by using the Azure
18693

18794
The **Ingress** settings page for your container app also allows you to configure **IP Restrictions**. For information to configure IP restriction, see [IP Restrictions](ip-restrictions.md).
18895

96+
::: zone-end
97+
98+
::: zone pivot="azure-resource-manager"
18999

190100
# [ARM template](#tab/arm-template)
191101

@@ -211,6 +121,10 @@ Enable ingress for your container app by using the `ingress` configuration prope
211121

212122
---
213123

124+
::: zone-end
125+
126+
::: zone pivot="azure-cli"
127+
214128
## Disable ingress
215129

216130
# [Azure CLI](#tab/azure-cli)
@@ -223,17 +137,30 @@ az containerapp ingress disable \
223137
--resource-group <resource-group> \
224138
```
225139

140+
::: zone-end
141+
142+
::: zone pivot="azure-portal"
143+
226144
# [Portal](#tab/portal)
227145

228-
Disable ingress for your container app by using the portal.
146+
You can disable ingress for your container app using the portal.
147+
148+
1. Select **Ingress** from the **Settings** menu of the container app page.
149+
1. Deselect the **Ingress** **Enabled** setting.
150+
1. Select **Save**.
151+
152+
:::image type="content" source="media/ingress/screenshot-disable-ingress.png" alt-text="Sceenshot of disabling container app ingress.":::
153+
154+
::: zone-end
155+
156+
::: zone pivot="azure-resource-manager"
229157

230158
# [ARM template](#tab/arm-template)
231159

232-
Disable ingress for your container app by omitting the `ingress` configuration property entirely.
160+
Disable ingress for your container app by omitting the `ingress` configuration property from `properties.configuration` entirely.
233161

234162
---
235163

236-
237164
## Next steps
238165

239166
> [!div class="nextstepaction"]

‎articles/container-apps/ingress-overview.md

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: container-apps
77
ms.topic: conceptual
8-
ms.date: 03/28/2023
8+
ms.date: 03/29/2023
99
ms.author: cshoe
1010
---
1111

@@ -23,9 +23,10 @@ Ingress supports:
2323
- [Traffic splitting between revisions](#traffic-splitting)
2424
- [Session affinity](#session-affinity)
2525

26+
<!--
2627
> [!NOTE]
2728
> Add diagram here, Talked with Anthony about this. He thought that we should consult Ahmed. I think that we should have a diagram that shows the ingress options and how they work together.
28-
29+
-->
2930
For configuration details, see [Configure ingress](ingress-how-to.md).
3031

3132
## External and internal ingress
@@ -80,15 +81,13 @@ With TCP ingress enabled, your container app:
8081

8182
You can access your app in the following ways:
8283

83-
- The default fully qualified domain name (FQDN). Each app in a Container Apps environment is automatically assigned an FQDN based on the environment's DNS suffix. To customize an environment's DNS suffix, see [Custom environment DNS Suffix](environment-custom-dns-suffix.md).
84+
- The default fully qualified domain name (FQDN): Each app in a Container Apps environment is automatically assigned an FQDN based on the environment's DNS suffix. To customize an environment's DNS suffix, see [Custom environment DNS Suffix](environment-custom-dns-suffix.md).
8485
- A custom domain name: You can configure a custom DNS domain for your Container Apps environment. For more information, see [Custom domain names and certificates](./custom-domains-certificates.md).
8586
- The app name: You can use the app name for communication between apps in the same environment.
8687

8788
## IP restrictions
8889

89-
Container Apps supports IP restrictions for ingress. You can create rules to either configure IP addresses that are allowed or denied access to your container app.
90-
91-
For more information, see [Configure IP restrictions](ip-restrictions.md).
90+
Container Apps supports IP restrictions for ingress. You can create rules to either configure IP addresses that are allowed or denied access to your container app. For more information, see [Configure IP restrictions](ip-restrictions.md).
9291

9392
## Authentication
9493

@@ -103,7 +102,7 @@ Containers Apps allows you to split incoming traffic between active revisions.
103102

104103
## Session affinity
105104

106-
Session affinity, also known as sticky sessions, is a feature that allows you to route all HTTP requests from a client to the same replica. This feature is useful for stateful applications that require a consistent connection to the same replica. For more information, see [Session affinity](sticky-sessions.md).
105+
Session affinity, also known as sticky sessions, is a feature that allows you to route all HTTP requests from a client to the same container app replica. This feature is useful for stateful applications that require a consistent connection to the same replica. For more information, see [Session affinity](sticky-sessions.md).
107106

108107
## Next steps
109108

‎articles/container-apps/ip-restrictions.md

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: container-apps
55
author: craigshoemaker
66
ms.service: container-apps
77
ms.topic: how-to
8-
ms.date: 03/20/2023
8+
ms.date: 03/28/2023
99
ms.author: cshoe
1010
zone_pivot_groups: azure-cli-or-portal
1111
---
@@ -14,7 +14,7 @@ zone_pivot_groups: azure-cli-or-portal
1414

1515
Azure Container Apps allows you to limit inbound traffic to your container app by configuring IP ingress restrictions via ingress configuration.
1616

17-
There are two types restrictions:
17+
There are two types of restrictions:
1818

1919
* *Allow*: Allow inbound traffic only from address ranges you specify in allow rules.
2020
* *Deny*: Deny all inbound traffic only from address ranges you specify in deny rules.
@@ -46,9 +46,11 @@ You can manage IP access restrictions rules through the Azure portal or Azure CL
4646
1. Go to your container app in the Azure portal.
4747
1. Select **Ingress** from the left side menu.
4848
1. Select the **IP Security Restrictions Mode** toggle to enable IP restrictions. You can choose to allow or deny traffic from the specified IP address ranges.
49-
1. Select **Add* to create the rule.
49+
1. Select **Add** to create the rule.
50+
5051
:::image type="content" source="media/ingress/screenshot-ingress-page-ip-restrictions.png" alt-text="Screenshot of IP restriction settings on container app Ingress page.":::
51-
1. Enter information in the following fields:
52+
53+
1. Enter values in the following fields:
5254

5355
| Field | Description |
5456
|-------|-------------|
@@ -58,7 +60,7 @@ You can manage IP access restrictions rules through the Azure portal or Azure CL
5860

5961
1. Select **Add**.
6062
1. Repeat steps 4-6 to add more rules.
61-
1. When you have finished adding rules, select **Save** to save the rules.
63+
1. When you have finished adding rules, select **Save**.
6264
:::image type="content" source="media/ingress/screenshot-save-ip-restriction.png" alt-text="Screenshot to save IP restrictions on container app Ingress page.":::
6365

6466
### Update a rule
@@ -185,4 +187,4 @@ az containerapp ingress access-restriction list
185187
## Next steps
186188

187189
> [!div class="nextstepaction"]
188-
> [Manage scaling](scale-app.md)
190+
> [Configure Ingress](ingress-how-to.md)

‎articles/container-apps/media/ingress/screenshot-disable-ingress.png

84.6 KB
Loading

‎articles/container-apps/sticky-sessions.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,15 @@ Session affinity is configured by setting the `affinity` property in the `ingres
5151

5252
You can enable session affinity when you create your container app via the Azure portal. To enable session affinity:
5353

54-
1. Go to the **App settings** tab.
54+
1. On the **Create Container App** page, select the **App settings** tab.
5555
1. In the **Application ingress settings** section, select **Enabled** for the **Session affinity** setting.
5656

5757

5858
:::image type="content" source="media/ingress/screenshot-session-affinity.png" alt-text="Screenshot of the session affinity setting in Create Container App page.":::
5959

6060
You can also enable or disable session affinity after your container app is created. To enable session affinity:
6161

62-
1. Go your app in the portal.
62+
1. Go to your app in the portal.
6363
1. Select **Ingress**.
6464
1. You can enable or disable **Session affinity** by selecting or deselecting **Enabled**.
6565
1. Select **Save**.

0 commit comments

Comments
 (0)