refactored Vnet content into 2 articles

Author: dlepow

articles/container-instances/container-instances-virtual-network-concepts.md

@@ -0,0 +1,82 @@
+---
+title: About using Azure Virtual Network
+description: Scenarios, limitations, and resources to deploy container groups to an Azure virtual network.
+ms.topic: article
+ms.date: 04/20/2020
+ms.author: danlep
+
+---
+
+# Virtual network background and scenarios
+
+[Azure Virtual Network](../virtual-network/virtual-networks-overview.md) provides secure, private networking for your Azure and on-premises resources. By deploying container groups into an Azure virtual network, your containers can communicate securely with other resources in the virtual network. This article provides background about virtual network scenarios, limitations, and resources.
+
+For deployment information, see:
+
+*[Deploy container instances into an Azure virtual network](container-instances-vnet.md).
+* [Regions and resource availability](container-instances-region-availability.md#availability---virtual-network-deployment) for container group deployments to a virtual network
+
+## Scenarios
+
+Container groups deployed into an Azure virtual network enable scenarios like:
+
+* Direct communication between container groups in the same subnet
+* Send [task-based](container-instances-restart-policy.md) workload output from container instances to a database in the virtual network
+* Retrieve content for container instances from a [service endpoint](../virtual-network/virtual-network-service-endpoints-overview.md) in the virtual network
+* Container communication with on-premises resources through a [VPN gateway](../vpn-gateway/vpn-gateway-about-vpngateways.md) or [ExpressRoute](../expressroute/expressroute-introduction.md)
+* Integrate with [Azure Firewall](../firewall/overview.md) to identify outbound traffic originating from the container 
+
+## Unsupported networking scenarios 
+
+* **Azure Load Balancer** - Placing an Azure Load Balancer in front of container instances in a networked container group is not supported
+* **Virtual network peering**
+  * You can only peer your virtual network to one other virtual network
+  * Global virtual network peering (connecting virtual networks across Azure regions) is not supported
+* **Private link** - Accessing Azure resources at a private endpoint over a private link is not supported
+* **Public IP or DNS label** - Container groups deployed to a virtual network don't currently support exposing containers directly to the internet with a public IP address or a fully qualified domain name
+* **Internal name resolution** - Name resolution for Azure resources in the virtual network via the internal Azure DNS is not supported
+
+## Other limitations
+
+* To deploy container groups to a subnet, the subnet can't contain other resource types. Remove all existing resources from an existing subnet prior to deploying container groups to it, or create a new subnet.
+* You can't use a [managed identity](container-instances-managed-identity.md) in a container group deployed to a virtual network.
+* You can't enable a [liveness probe](container-instances-liveness-probe.md) or [readiness probe](container-instances-readiness-probe.md) in a container group deployed to a virtual network.
+* Due to the additional networking resources involved, deploying a container group to a virtual network is typically slower than deploying a standard container instance.
+
+## Required network resources
+
+There are three Azure Virtual Network resources required for deploying container groups to a virtual network: the [virtual network](#virtual-network) itself, a [delegated subnet](#subnet-delegated) within the virtual network, and a [network profile](#network-profile). 
+
+### Virtual network
+
+A virtual network defines the address space in which you create one or more subnets. You then deploy Azure resources (like container groups) into the subnets in your virtual network.
+
+### Subnet (delegated)
+
+Subnets segment the virtual network into separate address spaces usable by the Azure resources you place in them. You create one or several subnets within a virtual network.
+
+The subnet that you use for container groups may contain only container groups. When you first deploy a container group to a subnet, Azure delegates that subnet to Azure Container Instances. Once delegated, the subnet can be used only for container groups. If you attempt to deploy resources other than container groups to a delegated subnet, the operation fails.
+
+### Network profile
+
+A network profile is a network configuration template for Azure resources. It specifies certain network properties for the resource, for example, the subnet into which it should be deployed. When you first use the [az container create][az-container-create] command to deploy a container group to a subnet (and thus a virtual network), Azure creates a network profile for you. You can then use that network profile for future deployments to the subnet. 
+
+To use a Resource Manager template, YAML file, or a programmatic method to deploy a container group to a subnet, you need to provide the full Resource Manager resource ID of a network profile. You can use a profile previously created using [az container create][az-container-create], or create a profile using a Resource Manager template (see [template example](https://github.com/Azure/azure-quickstart-templates/tree/master/101-aci-vnet) and [reference](https://docs.microsoft.com/azure/templates/microsoft.network/networkprofiles)). To get the ID of a previously created profile, use the [az network profile list][az-network-profile-list] command. 
+
+In the following diagram, several container groups have been deployed to a subnet delegated to Azure Container Instances. Once you've deployed one container group to a subnet, you can deploy additional container groups to it by specifying the same network profile.
+
+![Container groups within a virtual network][aci-vnet-01]
+
+## Next steps
+
+* For deployment examples with the Azure CLI, see [Deploy container instances into an Azure virtual network](container-instances-vnet.md).
+* To deploy a new virtual network, subnet, network profile, and container group using a Resource Manager template, see [Create an Azure container group with VNet](https://github.com/Azure/azure-quickstart-templates/tree/master/101-aci-vnet
+).
+
+
+<!-- IMAGES -->
+[aci-vnet-01]: ./media/container-instances-virtual-network-concepts/aci-vnet-01.png
+
+<!-- LINKS - Internal -->
+[az-container-create]: /cli/azure/container#az-container-create
+