You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. When you browse to the container app endpoint, you see the following message:
77
+
3. When you browse to the container app endpoint, you see the following message:
78
78
79
79
```
80
80
The public network access on this managed environment is disabled. To connect to this managed environment, please use the Private Endpoint from inside your virtual network. To learn more https://aka.ms/PrivateEndpointTroubleshooting.
81
81
```
82
82
83
-
Instead, you use an AFD endpoint to access your container app.
83
+
Instead, you use an Azure Front Door endpoint to access your container app.
84
84
85
85
## Create an Azure Front Door profile and endpoint
86
86
@@ -95,7 +95,7 @@ Create a resource group to organize the services related to your container app d
95
95
|--|--|
96
96
| Resource group | Select **my-container-apps**. |
97
97
| Name | Enter **my-afd-profile**. |
98
-
| Tier | Select **Premium**. Private link is not supported for origins in an AFD profile on the Standard tier. |
98
+
| Tier | Select **Premium**. Private link isn't supported for origins for Azure Front Door on the Standard tier. |
99
99
| Endpoint name | Enter **my-afd-endpoint**. |
100
100
| Origin type | Select **Container Apps**. |
101
101
| Origin host name | Enter the hostname of your container app. Your hostname looks like the following example: `my-container-app.orangeplant-77e5875b.centralus.azurecontainerapps.io`. |
@@ -127,11 +127,11 @@ Create a resource group to organize the services related to your container app d
127
127
1. In the *Private endpoint connections* page, approve each private endpoint connection request with the description `AFD Private Link Request`.
128
128
129
129
> [!NOTE]
130
-
> Azure Front Door might create multiple private endpoint connection requests. This is a known issue.
130
+
> Azure Front Door has a known issue where it might create multiple private endpoint connection requests.
131
131
132
132
## Access your container app from Azure Front Door
133
133
134
-
Browse to the AFD endpoint hostname you recorded previously. You see the output for the quickstart container app image. It takes a few minutes for your AFD profile to be deployed globally, so if you do not see the expected output at first, wait a few minutes and then refresh.
134
+
Browse to the Azure Front Door endpoint hostname you recorded previously. You see the output for the quickstart container app image. Global deployment could take a few minutes to deploy, so if you don't see the expected output, wait a few minutes and then refresh.
135
135
136
136
## Clean up resources
137
137
@@ -211,7 +211,7 @@ az group create \
211
211
--location $LOCATION
212
212
```
213
213
214
-
1. Retrieve the environment ID. You use this to configure the environment.
214
+
1. Retrieve the environment ID. You use this ID to configure the environment.
215
215
216
216
```azurecli
217
217
ENVIRONMENT_ID=$(az containerapp env show \
@@ -265,7 +265,7 @@ az group create \
265
265
az provider register --namespace Microsoft.Cdn
266
266
```
267
267
268
-
1. Create an AFD profile. Private link is not supported for origins in an AFD profile with SKU `Standard_AzureFrontDoor`.
268
+
1. Create an AFD profile. Private link isn't supported for origins in an AFD profile with SKU `Standard_AzureFrontDoor`.
Run the following command to approve the connection. Replace the \<PLACEHOLDER\> with the private endpoint connection resource ID you recorded in the previous section.
353
+
To approve the connection, run the following command. Replace the \<PLACEHOLDER\> with the private endpoint connection resource ID you recorded in the previous section.
354
354
355
355
```azurecli
356
356
az network private-endpoint-connection approve --id <PRIVATE_ENDPOINT_CONNECTION_RESOURCE_ID>
357
357
```
358
358
359
359
## Add a route
360
360
361
-
Run the following command to map the endpoint you created earlier to the origin group. Private endpoints on Azure Container Apps only support inbound HTTP traffic. TCP traffic is not supported.
361
+
Run the following command to map the endpoint you created earlier to the origin group. Private endpoints on Azure Container Apps only support inbound HTTP traffic. TCP traffic isn't supported.
362
362
363
363
```azurecli
364
364
az afd route create \
@@ -394,14 +394,14 @@ az afd route create \
394
394
395
395
1. Browse to the hostname. You see the output for the quickstart container app image.
396
396
397
-
It takes a few minutes for your AFD profile to be deployed globally, so if you do not see the expected output at first, wait a few minutes and then refresh.
397
+
If you don't see the expected output at first, wait a few minutes and then refresh.
398
398
399
399
## Clean up resources
400
400
401
-
If you're not going to continue to use this application, you can remove the **my-container-apps** resource group. This deletes the Azure Container Apps instance and all associated services. It also deletes the resource group that the Container Apps service automatically created and which contains the custom network components.
401
+
If you're not going to continue to use this application, you can remove the **my-container-apps** resource group. This action deletes the Azure Container Apps instance and all associated services. It also deletes the resource group that the Container Apps service automatically created and which contains the custom network components.
402
402
403
403
> [!CAUTION]
404
-
> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they will also be deleted.
404
+
> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they'll also be deleted.
Copy file name to clipboardExpand all lines: articles/container-apps/how-to-use-private-endpoint.md
+13-13Lines changed: 13 additions & 13 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ In this article, you learn how to use a private endpoint to securely access your
17
17
18
18
A private endpoint uses a private IP address from your virtual network (VNet). This endpoint connects you privately and securely to a service powered by [Azure Private Link](/azure/private-link/private-link-overview).
19
19
20
-
Private endpoints on Azure Container Apps only support inbound HTTP traffic. TCP traffic is not supported.
20
+
Private endpoints on Azure Container Apps only support inbound HTTP traffic. TCP traffic isn't supported.
21
21
22
22
::: zone pivot="azure-portal"
23
23
@@ -58,7 +58,7 @@ Begin by signing in to the [Azure portal](https://portal.azure.com).
58
58
1. Set *Public Network Access* to **Disable: Block all incoming traffic from the public internet.** By default, public network access is enabled, which means private endpoints are disabled.
59
59
60
60
1. Leave **Use your own virtual network** set to **No**.
61
-
You can use an existing VNet, but private endpoints are only supported by workload profiles environments, which require a subnet with a minimum CIDR range of `/27` or larger. To learn more about subnet sizing, see the [networking architecture overview](./networking.md#subnet).
61
+
You can use an existing VNet, but private endpoints are only supported in workload profiles environments, which require a subnet with a minimum CIDR range of `/27` or larger. To learn more about subnet sizing, see the [networking architecture overview](./networking.md#subnet).
62
62
63
63
1. Set *Enable private endpoints* to **Yes**.
64
64
@@ -83,7 +83,7 @@ Begin by signing in to the [Azure portal](https://portal.azure.com).
1. When you browse to the container app endpoint, you see the following message:
86
+
4. When you browse to the container app endpoint, you see the following message:
87
87
88
88
```
89
89
The public network access on this managed environment is disabled. To connect to this managed environment, please use the Private Endpoint from inside your virtual network. To learn more https://aka.ms/PrivateEndpointTroubleshooting.
@@ -144,7 +144,7 @@ az group create \
144
144
145
145
## Create a virtual network
146
146
147
-
1. Create an Azure virtual network (VNet). You can use an existing VNet, but private endpoints are only supported by workload profiles environments, which require a subnet with a minimum CIDR range of `/27` or larger. To learn more about subnet sizing, see the [networking architecture overview](./networking.md#subnet).
147
+
1. Create an Azure virtual network (VNet). You can use an existing VNet, but private endpoints are only supported in workload profiles environments, which require a subnet with a minimum CIDR range of `/27` or larger. To learn more about subnet sizing, see the [networking architecture overview](./networking.md#subnet).
148
148
149
149
```azurecli
150
150
az network vnet create \
@@ -164,7 +164,7 @@ az group create \
164
164
--address-prefixes 10.0.0.0/21
165
165
```
166
166
167
-
1. Retrieve the subnet ID. You use this to create the private endpoint.
167
+
1. Retrieve the subnet ID. You use this ID to create the private endpoint.
168
168
169
169
```azurecli
170
170
SUBNET_ID=$(az network vnet subnet show \
@@ -177,7 +177,7 @@ az group create \
177
177
178
178
## Create an environment
179
179
180
-
1. Create the Container Apps environment. Private endpoints are only supported by workload profiles environments, which is the default type for new environments.
180
+
1. Create the Container Apps environment. Private endpoints are only supported in workload profiles environments, which is the default type for new environments.
181
181
182
182
```azurecli
183
183
az containerapp env create \
@@ -186,7 +186,7 @@ az group create \
186
186
--location $LOCATION
187
187
```
188
188
189
-
1. Retrieve the environment ID. You use this to configure the environment.
189
+
1. Retrieve the environment ID. You use this ID to configure the environment.
190
190
191
191
```azurecli
192
192
ENVIRONMENT_ID=$(az containerapp env show \
@@ -196,7 +196,7 @@ az group create \
196
196
--output tsv)
197
197
```
198
198
199
-
1. Disable public network access for the environment. This is needed to enable private endpoints.
199
+
1. Disable public network access for the environment. This setting is needed to enable private endpoints.
200
200
201
201
```azurecli
202
202
az containerapp env update \
@@ -221,7 +221,7 @@ az network private-endpoint create \
221
221
222
222
### Configure the private DNS zone
223
223
224
-
1. Retrieve the private endpoint IP address. You use this to add a DNS record to your private DNS zone.
224
+
1. Retrieve the private endpoint IP address. You use this address to add a DNS record to your private DNS zone.
225
225
226
226
```azurecli
227
227
PRIVATE_ENDPOINT_IP_ADDRESS=$(az network private-endpoint show \
@@ -231,7 +231,7 @@ az network private-endpoint create \
231
231
--output tsv)
232
232
```
233
233
234
-
1. Retrieve the environment default domain. You use this to add a DNS record to your private DNS zone.
234
+
1. Retrieve the environment default domain. You use this domain to add a DNS record to your private DNS zone.
235
235
236
236
```azurecli
237
237
DNS_RECORD_NAME=$(az containerapp env show \
@@ -366,7 +366,7 @@ The administrator username must be between 1 and 20 characters long.
366
366
367
367
The administrator password has the following requirements:
368
368
- Must be between 12 and 123 characters long.
369
-
- Must have 3 of the following: 1 lower case character, 1 upper case character, 1 number, and 1 special character.
369
+
- Must have three of the following characters: 1 lower case character, 1 upper case character, 1 number, and 1 special character.
370
370
371
371
::: zone-end
372
372
@@ -411,12 +411,12 @@ The administrator password has the following requirements:
411
411
412
412
## Clean up resources
413
413
414
-
If you're not going to continue to use this application, you can remove the **my-container-apps** resource group. This deletes the Azure Container Apps instance and all associated services.
414
+
If you're not going to continue to use this application, you can remove the **my-container-apps** resource group. This action deletes the Azure Container Apps instance and all associated services.
415
415
416
416
::: zone pivot="azure-cli"
417
417
418
418
> [!CAUTION]
419
-
> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they will also be deleted.
419
+
> The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they'll also be deleted.
0 commit comments