You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/container-apps/dns.md
+29-4Lines changed: 29 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,15 +1,15 @@
1
1
---
2
-
title: Configure a DNS for virtual networks in Azure Container Apps environments
3
-
description: Learn how to configure DNS for virtual networks in Azure Container Apps.
2
+
title: Configure private endpoints and DNS for virtual networks in Azure Container Apps environments
3
+
description: Learn how to configure private endpoints and DNS for virtual networks in Azure Container Apps.
4
4
services: container-apps
5
5
author: craigshoemaker
6
6
ms.service: azure-container-apps
7
7
ms.topic: conceptual
8
-
ms.date: 10/03/2024
8
+
ms.date: 06/16/2025
9
9
ms.author: cshoe
10
10
---
11
11
12
-
# DNS for virtual networks in Azure Container Apps environments
12
+
# Private endpoints and DNS for virtual networks in Azure Container Apps environments
13
13
14
14
Configuring DNS in your Azure Container Apps environment's virtual network is important for the following reasons:
15
15
@@ -31,6 +31,31 @@ If you plan to use VNet-scope [ingress](ingress-overview.md) in an internal envi
31
31
32
32
The static IP address of the Container Apps environment is available in the Azure portal in **Custom DNS suffix** of the container app page or using the Azure CLI `az containerapp env list` command.
33
33
34
+
## <aname="private-endpoint"></a>Private endpoint
35
+
36
+
Azure private endpoint enables clients located in your private network to securely connect to your Azure Container Apps environment through Azure Private Link. A private link connection eliminates exposure to the public internet. Private endpoints use a private IP address in your Azure virtual network address space.
37
+
38
+
This feature is supported for both Consumption and Dedicated plans in workload profile environments.
39
+
40
+
### Tutorials
41
+
- To learn more about how to configure private endpoints in Azure Container Apps, see the [Use a private endpoint with an Azure Container Apps environment](how-to-use-private-endpoint.md) tutorial.
42
+
- Private link connectivity with Azure Front Door is supported for Azure Container Apps. Refer to [create a private link with Azure Front Door](how-to-integrate-with-azure-front-door.md) for more information.
43
+
44
+
### Considerations
45
+
46
+
- To use a private endpoint, you must disable [public network access](#public-network-access). By default, public network access is enabled, which means private endpoints are disabled.
47
+
- To use a private endpoint with a custom domain and an *Apex domain* as the *Hostname record type*, you must configure a private DNS zone with the same name as your public DNS. In the record set, configure your private endpoint's private IP address instead of the container app environment's IP address. When you configure your custom domain with CNAME, the setup is unchanged. For more information, see [Set up custom domain with existing certificate](custom-domains-certificates.md).
48
+
- Your private endpoint's VNet can be separate from the VNet integrated with your container app.
49
+
- You can add a private endpoint to both new and existing workload profile environments.
50
+
51
+
In order to connect to your container apps through a private endpoint, you must configure a private DNS zone.
You can also [use private endpoints with a private connection to Azure Front Door](how-to-integrate-with-azure-front-door.md) in place of Application Gateway.
Copy file name to clipboardExpand all lines: articles/container-apps/ingress-environment-configuration.md
+83-1Lines changed: 83 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,6 +13,8 @@ ms.custom:
13
13
14
14
# Configure ingress for an Azure Container Apps environment
15
15
16
+
Azure Container Apps run in the context of an environment, with its own virtual network (VNet). This VNet creates a secure boundary around your Azure Container Apps [environment](environment.md).
17
+
16
18
Ingress configuration in Azure Container Apps determines how external network traffic reaches your applications. Configuring ingress enables you to control traffic routing, improve application performance, and implement advanced deployment strategies. This article guides you through the ingress configuration options available in Azure Container Apps and helps you choose the right settings for your workloads.
17
19
18
20
An Azure Container Apps environment includes a scalable edge ingress proxy responsible for the following features:
@@ -110,7 +112,87 @@ You can configure the ingress for your environment after you create it.
110
112
111
113
1. Select **Apply**.
112
114
115
+
## Rule-based routing (preview)
116
+
117
+
With rule-based routing, you create a fully qualified domain name (FQDN) on your container apps environment. You then use rules to route requests to this FQDN to different container apps, depending on the path of each request. This offers the following benefits.
118
+
119
+
- Isolation: By routing different paths to different container apps, you can deploy and update individual components without affecting the entire application.
120
+
121
+
- Scalability: With rule-based routing, you can scale individual container apps independently based on the traffic each container app receives.
122
+
123
+
- Custom Routing Rules: You can, for example, redirect users to different versions of your application or implement A/B testing.
124
+
125
+
- Security: You can implement security measures tailored to each container app. This helps you to reduce the attack surface of your application.
126
+
127
+
To learn how to configure rule-based routing on your container apps environment, see [Use rule-based routing](rule-based-routing.md).
128
+
129
+
## <aname="peer-to-peer-encryption"></a> Peer-to-peer encryption in the Azure Container Apps environment
130
+
131
+
Azure Container Apps supports peer-to-peer TLS encryption within the environment. Enabling this feature encrypts all network traffic within the environment with a private certificate that is valid within the Azure Container Apps environment scope. Azure Container Apps automatically manages these certificates.
132
+
133
+
> [!NOTE]
134
+
> By default, peer-to-peer encryption is disabled. Enabling peer-to-peer encryption for your applications may increase response latency and reduce maximum throughput in high-load scenarios.
135
+
136
+
The following example shows an environment with peer-to-peer encryption enabled.
137
+
:::image type="content" source="media/networking/peer-to-peer-encryption-traffic-diagram.png" alt-text="Diagram of how traffic is encrypted/decrypted with peer-to-peer encryption enabled.":::
138
+
139
+
<sup>1</sup> Inbound TLS traffic is terminated at the ingress proxy on the edge of the environment.
140
+
141
+
<sup>2</sup> Traffic to and from the ingress proxy within the environment is TLS encrypted with a private certificate and decrypted by the receiver.
142
+
143
+
<sup>3</sup> Calls made from app A to app B's FQDN are first sent to the edge ingress proxy, and are TLS encrypted.
144
+
145
+
<sup>4</sup> Calls made from app A to app B using app B's app name are sent directly to app B and are TLS encrypted. Calls between apps and [Java components](./java-overview.md#java-components-support) are treated in the same way as app to app communication and TLS encrypted.
146
+
147
+
Applications within a Container Apps environment are automatically authenticated. However, the Container Apps runtime doesn't support authorization for access control between applications using the built-in peer-to-peer encryption.
148
+
149
+
When your apps are communicating with a client outside of the environment, two-way authentication with mTLS is supported. To learn more, see [configure client certificates](client-certificate-authorization.md).
150
+
151
+
# [Azure CLI](#tab/azure-cli)
152
+
153
+
You can enable peer-to-peer encryption using the following commands.
154
+
155
+
On create:
156
+
157
+
```azurecli
158
+
az containerapp env create \
159
+
--name <ENVIRONMENT_NAME> \
160
+
--resource-group <RESOURCE_GROUP> \
161
+
--location <LOCATION> \
162
+
--enable-peer-to-peer-encryption
163
+
```
164
+
165
+
For an existing container app:
166
+
167
+
```azurecli
168
+
az containerapp env update \
169
+
--name <ENVIRONMENT_NAME> \
170
+
--resource-group <RESOURCE_GROUP> \
171
+
--enable-peer-to-peer-encryption
172
+
```
173
+
174
+
# [ARM template](#tab/arm-template)
175
+
176
+
You can enable peer-to-peer encryption in the ARM template for Container Apps environments using the following configuration.
177
+
178
+
```json
179
+
{
180
+
...
181
+
"properties": {
182
+
"peerTrafficConfiguration":{
183
+
"encryption": {
184
+
"enabled": "true|false"
185
+
}
186
+
}
187
+
...
188
+
}
189
+
```
190
+
191
+
---
192
+
113
193
## Related content
114
194
115
195
- [Ingress in Azure Container Apps](ingress-overview.md)
116
-
-[Networking in Azure Container Apps](networking.md)
196
+
- [Networking in Azure Container Apps](networking.md)
Azure private endpoint enables clients located in your private network to securely connect to your Azure Container Apps environment through Azure Private Link. A private link connection eliminates exposure to the public internet. Private endpoints use a private IP address in your Azure virtual network address space.
72
-
73
-
This feature is supported for both Consumption and Dedicated plans in workload profile environments.
74
-
75
-
#### Tutorials
76
-
- To learn more about how to configure private endpoints in Azure Container Apps, see the [Use a private endpoint with an Azure Container Apps environment](how-to-use-private-endpoint.md) tutorial.
77
-
- Private link connectivity with Azure Front Door is supported for Azure Container Apps. Refer to [create a private link with Azure Front Door](how-to-integrate-with-azure-front-door.md) for more information.
78
-
79
-
#### Considerations
80
-
81
-
- To use a private endpoint, you must disable [public network access](#public-network-access). By default, public network access is enabled, which means private endpoints are disabled.
82
-
- To use a private endpoint with a custom domain and an *Apex domain* as the *Hostname record type*, you must configure a private DNS zone with the same name as your public DNS. In the record set, configure your private endpoint's private IP address instead of the container app environment's IP address. When you configure your custom domain with CNAME, the setup is unchanged. For more information, see [Set up custom domain with existing certificate](custom-domains-certificates.md).
83
-
- Your private endpoint's VNet can be separate from the VNet integrated with your container app.
84
-
- You can add a private endpoint to both new and existing workload profile environments.
85
-
86
-
In order to connect to your container apps through a private endpoint, you must configure a private DNS zone.
You can also [use private endpoints with a private connection to Azure Front Door](how-to-integrate-with-azure-front-door.md) in place of Application Gateway.
93
-
94
69
### Ingress configuration
95
70
96
71
Under the [ingress](azure-resource-manager-api-spec.md#propertiesconfiguration) section, you can configure the following settings:
@@ -108,11 +83,13 @@ For more information about different networking scenarios, see [Ingress in Azure
108
83
|Feature |Learn how to |
109
84
|---------|---------|
110
85
|[Ingress](ingress-overview.md)<br><br>[Configure ingress](ingress-how-to.md)| Control the routing of external and internal traffic to your container app. |
86
+
|[Premium ingress](ingress-environment-configuration.md)| Configure advanced ingress settings such as workload profile support for ingress and idle timeout. |
111
87
|[IP restrictions](ip-restrictions.md)| Restrict inbound traffic to your container app by IP address. |
112
88
|[Client certificate authentication](client-certificate-authorization.md)| Configure client certificate authentication (also known as mutual TLS or mTLS) for your container app. |
113
89
|[Traffic splitting](traffic-splitting.md)<br><br>[Blue/Green deployment](blue-green-deployment.md)| Split incoming traffic between active revisions of your container app. |
114
90
|[Session affinity](sticky-sessions.md)| Route all requests from a client to the same replica of your container app. |
115
91
|[Cross origin resource sharing (CORS)](cors.md)| Enable CORS for your container app, which allows requests made through the browser to a domain that doesn't match the page's origin. |
92
+
|[Path-based routing](rule-based-routing.md)| Use rules to route requests to different container apps in your environment, depending on the path of each request. |
116
93
|[Virtual networks](custom-virtual-networks.md)| Configure the VNet for your container app environment. |
117
94
|[DNS](dns.md)| Configure DNS for your container app environment's VNet. |
118
95
|[Private endpoint](how-to-use-private-endpoint.md)| Use a private endpoint to securely access your Azure Container App without exposing it to the public Internet. |
0 commit comments