Skip to content

Commit 9ecf7fc

Browse files
hmacgregor1hmacgregor1
authored
Merge pull request #181308 from v-kevinmic3/jieshe/update-access
Jieshe/Rearrange Azure Spring Cloud access app in virtual network
2 parents be635a7 + a68348e commit 9ecf7fc

File tree

1 file changed

+67
-66
lines changed

1 file changed

+67
-66
lines changed

‎articles/spring-cloud/access-app-virtual-network.md

Lines changed: 67 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,70 @@
11
---
22
title: "Azure Spring Cloud access app in virtual network"
3-
description: Access app in an Azure Spring Cloud in virtual network.
3+
description: Access app in Azure Spring Cloud in a virtual network.
44
author: karlerickson
55
ms.author: karler
66
ms.service: spring-cloud
77
ms.topic: how-to
8-
ms.date: 11/11/2020
8+
ms.date: 11/30/2021
99
ms.custom: devx-track-java
1010
---
1111

1212
# Access your application in a private network
1313

14-
This document explains how to access an endpoint for your application in a private network. In order to get access, you need to create an **Azure Private DNS Zone** in your subscription to translate/resolve the private fully qualified domain name (FQDN) to its IP address.
14+
This document explains how to access an endpoint for your application in a private network.
1515

16-
When **Assign Endpoint** for applications in an Azure Spring Cloud service instance is deployed in your virtual network, the endpoint is a private FQDN. The domain is only accessible in the private network. Apps and services use the application endpoint. They include the **Test Endpoint** described in [View apps and deployments](./how-to-staging-environment.md#view-apps-and-deployments). **Log streaming**, described in [Stream Azure Spring Cloud app logs in real-time](./how-to-log-streaming.md), also works only within the private network.
16+
When **Assign Endpoint** on applications in an Azure Spring Cloud service instance is deployed in your virtual network, the endpoint is a private fully qualified domain name (FQDN). The domain is only accessible in the private network. Apps and services use the application endpoint. They include the *Test Endpoint* described in [View apps and deployments](./how-to-staging-environment.md#view-apps-and-deployments). *Log streaming*, described in [Stream Azure Spring Cloud app logs in real-time](./how-to-log-streaming.md), also works only within the private network.
17+
18+
## Find the IP for your application
19+
20+
#### [Portal](#tab/azure-portal)
21+
22+
1. Select the virtual network resource you created as explained in [Deploy Azure Spring Cloud in your Azure virtual network (VNet injection)](./how-to-deploy-in-azure-virtual-network.md).
23+
24+
2. In the **Connected devices** search box, enter *kubernetes-internal*.
25+
26+
3. In the filtered result, find the **Device** connected to the service runtime **Subnet** of the service instance, and copy its **IP Address**. In this sample, the IP Address is *10.1.0.7*.
27+
28+
[ ![Create DNS record](media/spring-cloud-access-app-vnet/create-dns-record.png) ](media/spring-cloud-access-app-vnet/create-dns-record.png)
29+
30+
#### [CLI](#tab/azure-CLI)
31+
32+
Find the IP Address for your Spring Cloud services. Customize the value of your spring cloud name based on your real environment.
33+
34+
```azurecli
35+
SPRING_CLOUD_NAME='spring-cloud-name'
36+
SERVICE_RUNTIME_RG=`az spring-cloud show \
37+
--resource-group $RESOURCE_GROUP \
38+
--name $SPRING_CLOUD_NAME \
39+
--query "properties.networkProfile.serviceRuntimeNetworkResourceGroup" \
40+
--output tsv`
41+
IP_ADDRESS=`az network lb frontend-ip list \
42+
--lb-name kubernetes-internal \
43+
--resource-group $SERVICE_RUNTIME_RG \
44+
--query "[0].privateIpAddress" \
45+
--output tsv`
46+
```
47+
48+
---
49+
50+
## Add a DNS for the IP
51+
52+
If you have your own DNS solution for your virtual network, like Active Directory Domain Controller, Infoblox, or another, you need to point the domain `*.private.azuremicroservices.io` to the [IP address](#find-the-ip-for-your-application). Otherwise, you can follow the following instructions to create an **Azure Private DNS Zone** in your subscription to translate/resolve the private fully qualified domain name (FQDN) to its IP address.
53+
54+
> [!NOTE]
55+
> If you are using Azure China, please replace `private.azuremicroservices.io` with `private.microservices.azure.cn` in this documentation. Learn more about [Check Endpoints in Azure](/azure/china/resources-developer-guide#check-endpoints-in-azure).
1756
1857
## Create a private DNS zone
1958

2059
The following procedure creates a private DNS zone for an application in the private network.
2160

2261
#### [Portal](#tab/azure-portal)
2362

24-
1. Open the Azure portal. From the top search box, search for **Private DNS zones**, and select **Private DNS zones** from the result.
63+
1. Open the Azure portal. From the top search box, search for **Private DNS zones**, and select **Private DNS zones** from the results.
2564

2665
2. On the **Private DNS zones** page, select **Add**.
2766

28-
3. Fill out the form on the **Create Private DNS zone** page. Enter **<span>private.azuremicroservices.io</span>** as the **Name** of the zone.
29-
30-
>[!NOTE]
31-
> If you are using Azure China, please replace `private.azuremicroservices.io` with `private.microservices.azure.cn` for the whole documentation, [learn more](/azure/china/resources-developer-guide#check-endpoints-in-azure).
67+
3. Fill out the form on the **Create Private DNS zone** page. Enter *private.azuremicroservices.io* as the **Name** of the zone.
3268

3369
4. Select **Review + Create**.
3470

@@ -54,8 +90,9 @@ The following procedure creates a private DNS zone for an application in the pri
5490
1. Create the private DNS zone.
5591

5692
```azurecli
57-
az network private-dns zone create --resource-group $RESOURCE_GROUP \
58-
--name private.azuremicroservices.io
93+
az network private-dns zone create \
94+
--resource-group $RESOURCE_GROUP \
95+
--name private.azuremicroservices.io
5996
```
6097

6198
---
@@ -68,13 +105,11 @@ To link the private DNS zone to the virtual network, you need to create a virtua
68105

69106
#### [Portal](#tab/azure-portal)
70107

71-
1. Select the private DNS zone resource created above: **<span>private.azuremicroservices.io</span>**
72-
73-
2. On the left pane, select **Virtual network links**.
108+
1. Select the private DNS zone resource created above: *private.azuremicroservices.io*
74109

75-
3. Select **Add**.
110+
2. On the left pane, select **Virtual network links**, then select **Add**.
76111

77-
4. Enter **azure-spring-cloud-dns-link** for the **Link name**.
112+
4. Enter *azure-spring-cloud-dns-link* for the **Link name**.
78113

79114
5. For **Virtual network**, select the virtual network you created as explained in [Deploy Azure Spring Cloud in your Azure virtual network (VNet injection)](./how-to-deploy-in-azure-virtual-network.md).
80115

@@ -84,16 +119,16 @@ To link the private DNS zone to the virtual network, you need to create a virtua
84119

85120
#### [CLI](#tab/azure-CLI)
86121

87-
Link the private DNS zone you just created to the virtual network holding your Azure Spring Cloud service.
122+
Link the private DNS zone you created to the virtual network holding your Azure Spring Cloud service.
88123

89124
```azurecli
90-
az network private-dns link vnet create --resource-group $RESOURCE_GROUP \
125+
az network private-dns link vnet create \
126+
--resource-group $RESOURCE_GROUP \
91127
--name azure-spring-cloud-dns-link \
92128
--zone-name private.azuremicroservices.io \
93129
--virtual-network $VIRTUAL_NETWORK_NAME \
94130
--registration-enabled false
95131
```
96-
97132
---
98133

99134
## Create DNS record
@@ -102,62 +137,27 @@ To use the private DNS zone to translate/resolve DNS, you must create an "A" typ
102137

103138
#### [Portal](#tab/azure-portal)
104139

105-
1. Select the virtual network resource you created as explained in [Deploy Azure Spring Cloud in your Azure virtual network (VNet injection)](./how-to-deploy-in-azure-virtual-network.md).
106-
107-
2. In the **Connected devices** search box, enter *kubernetes-internal*.
108-
109-
3. In the filtered result, find the **Device** connected to the service runtime **Subnet** of the service instance, and copy its **IP Address**. In this sample, the IP Address is *10.1.0.7*.
110-
111-
[ ![Create DNS record](media/spring-cloud-access-app-vnet/create-dns-record.png) ](media/spring-cloud-access-app-vnet/create-dns-record.png)
112-
113-
Or, you can fetch the IP using the following az CLI command:
114-
115-
```azurecli
116-
SPRING_CLOUD_RG= # Resource group name of your Azure Spring Cloud service instance
117-
SPRING_CLOUD= # Name of your Azure Spring Cloud service instance
118-
119-
SERVICE_RUNTIME_RG=`az spring-cloud show -g $SPRING_CLOUD_RG -n $SPRING_CLOUD --query \
120-
"properties.networkProfile.serviceRuntimeNetworkResourceGroup" -o tsv`
121-
122-
IP_ADDRESS=`az network lb frontend-ip list --lb-name kubernetes-internal -g \
123-
$SERVICE_RUNTIME_RG --query "[0].privateIpAddress" -o tsv`
124-
```
125-
126-
4. Select the private DNS zone resource created above: **<span>private.azuremicroservices.io</span>**.
140+
1. Select the private DNS zone resource created above: *private.azuremicroservices.io*.
127141

128-
5. Select **Record set**.
142+
1. Select **Record set**.
129143

130-
6. In **Add record set**, enter or select this information:
144+
1. In **Add record set**, enter or select this information:
131145

132146
|Setting |Value |
133147
|------------|---------------------------------------------------------------------------|
134148
|Name |Enter *\** |
135149
|Type |Select **A** |
136150
|TTL |Enter *1* |
137151
|TTL unit |Select **Hours** |
138-
|IP address |Enter the IP address copied in step 3. In the sample, enter *10.1.0.7*. |
152+
|IP address |Enter the IP address copied in step 3. In the sample, the IP is *10.1.0.7*. |
139153

140-
Then select **OK**.
154+
1. Select **OK**.
141155

142156
![Add private DNS zone record](media/spring-cloud-access-app-vnet/private-dns-zone-add-record.png)
143157

144158
#### [CLI](#tab/azure-CLI)
145159

146-
1. Find the IP Address for your Spring Cloud services. Customize the value of your spring cloud name based on your real environment.
147-
148-
```azurecli
149-
SPRING_CLOUD_NAME='spring-cloud-name'
150-
SERVICE_RUNTIME_RG=`az spring-cloud show --resource-group $RESOURCE_GROUP \
151-
--name $SPRING_CLOUD_NAME --query \
152-
"properties.networkProfile.serviceRuntimeNetworkResourceGroup" \
153-
--output tsv`
154-
IP_ADDRESS=`az network lb frontend-ip list --lb-name kubernetes-internal \
155-
--resource-group $SERVICE_RUNTIME_RG \
156-
--query "[0].privateIpAddress" \
157-
--output tsv`
158-
```
159-
160-
1. Use this IP address to create the A record in your DNS zone.
160+
Use the [IP address](#find-the-ip-for-your-application) to create the A record in your DNS zone.
161161

162162
```azurecli
163163
az network private-dns record-set a add-record \
@@ -171,27 +171,28 @@ $SERVICE_RUNTIME_RG --query "[0].privateIpAddress" -o tsv`
171171

172172
## Assign private FQDN for your application
173173

174-
After following the procedure in [Build and deploy microservice applications](./how-to-deploy-in-azure-virtual-network.md), you can assign private FQDN for your application.
174+
After following the procedure in [Build and deploy microservice applications](./how-to-deploy-in-azure-virtual-network.md), you can assign a private FQDN for your application.
175175

176176
#### [Portal](#tab/azure-portal)
177177

178178
1. Select the Azure Spring Cloud service instance deployed in your virtual network, and open the **Apps** tab in the menu on the left.
179179

180180
2. Select the application to show the **Overview** page.
181181

182-
3. Select **Assign Endpoint** to assign a private FQDN to your application. This can take a few minutes.
182+
3. Select **Assign Endpoint** to assign a private FQDN to your application. Assigning an FQDN can take a few minutes.
183183

184184
![Assign private endpoint](media/spring-cloud-access-app-vnet/assign-private-endpoint.png)
185185

186-
4. The assigned private FQDN (labeled **URL**) is now available. It can only be accessed within the private network, but not on Internet.
186+
4. The assigned private FQDN (labeled **URL**) is now available. It can only be accessed within the private network, but not on the Internet.
187187

188188
#### [CLI](#tab/azure-CLI)
189189

190-
Update your app to assign an endpoint to it. Customize the value of your spring app name based on your real environment.
190+
Update your app to assign an endpoint to it. Customize the value of your app name based on your real environment.
191191

192192
```azurecli
193193
SPRING_CLOUD_APP='your spring cloud app'
194-
az spring-cloud app update --name $SPRING_CLOUD_APP \
194+
az spring-cloud app update \
195+
--name $SPRING_CLOUD_APP \
195196
--resource-group $RESOURCE_GROUP \
196197
--service $SPRING_CLOUD_NAME \
197198
--assign-endpoint true
@@ -201,7 +202,7 @@ az spring-cloud app update --name $SPRING_CLOUD_APP \
201202

202203
## Access application private FQDN
203204

204-
After the assignment, you can access the private FQDN of your application in private network. For example, you can create a jumpbox machine in the same virtual network, or a peered virtual network, and on that jumpbox machine the private FQDN is accessible.
205+
After the assignment, you can access the private FQDN of your application in the private network. For example, you can create a jumpbox machine in the same virtual network, or a peered virtual network. Then on that jumpbox or virtual machine the private FQDN is accessible.
205206

206207
![Access private endpoint in vnet](media/spring-cloud-access-app-vnet/access-private-endpoint.png)
207208

0 commit comments

Comments
 (0)