Skip to content

Commit 4b89827

Browse files
Craig ShoemakerCraig Shoemaker
Craig Shoemaker
authored and
Craig Shoemaker
committed
rewrite
1 parent 11f8b4f commit 4b89827

1 file changed

Lines changed: 228 additions & 96 deletions

File tree

‎articles/container-apps/front-door-custom-virtual-network-private-link.md‎

Lines changed: 228 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -1,142 +1,274 @@
11
---
2-
title: Azure Container Apps with Azure Front Door Premium using Private Link
3-
description: Deploy Azure Container Apps in a custom virtual network with internal ingress and expose them securely using Azure Front Door Premium via Private Link.
4-
#customer intent: As a cloud architect, I want to deploy Azure Container Apps in a secure virtual network so that I can ensure private access using Azure Front Door Premium with Private Link.
2+
title: Use Azure Front Door Premium with a custom virtual network and Private Link in Azure Container Apps
3+
description: Learn how to deploy an Azure Container Apps environment in a custom virtual network with internal ingress and expose it securely through Azure Front Door Premium with Private Link.
4+
#customer intent: As a cloud architect, I want to deploy Azure Container Apps in a secure custom virtual network so that I can route inbound traffic privately through Azure Front Door Premium with Private Link.
55
author: kkaushal24011982
66
ms.author: kkaushal
77
ms.reviewer: cshoe
88
ms.service: azure-container-apps
9-
ms.topic: conceptual
9+
ms.custom:
10+
- build-2025
11+
ms.topic: how-to
1012
ms.date: 03/05/2026
1113
---
1214

13-
# Use Azure Front Door with Azure Container Apps and Private Link
15+
# Use Azure Front Door Premium with a custom virtual network and Private Link
1416

15-
This article explains how to deploy an Azure Container Apps environment by using workload profiles in a custom virtual network with an internal virtual IP (internal load balancer) and public network access disabled. It also covers how to expose your container apps privately through Azure Front Door Premium by using Private Link and private endpoints. This configuration enables a secure inbound path while maintaining zone redundancy.
17+
In this article, you learn how to deploy an Azure Container Apps environment in a custom virtual network with an internal virtual IP (VIP) and public network access disabled. You then expose the environment securely through Azure Front Door Premium by using Private Link and private endpoints. This configuration provides a secure inbound path to your container apps while supporting zone redundancy.
18+
19+
> [!IMPORTANT]
20+
> There are [more charges](./private-endpoints-with-dns.md#billing) for enabling private endpoints in both the Dedicated and Consumption plans.
1621
1722
## Prerequisites
1823

19-
- An Azure account with an active subscription.
20-
- Permissions to create resources: resource groups, virtual networks, private endpoints, Azure Container Apps, Log Analytics workspaces, and Azure Front Door profiles.
21-
- An Azure Container Apps environment that uses **workload profiles**. This environment type is required for combining VNet integration, private endpoints, and zone redundancy.
22-
- **Azure Front Door Premium**. This SKU is required to configure Private Link origins.
23-
- A dedicated subnet for private endpoints (separate from the delegated Container Apps subnet).
24+
- Azure account with an active subscription.
25+
- If you don't have one, [create one for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
26+
27+
- This feature only supports workload profile environments.
2428

25-
For more information about networking requirements, see [Custom virtual network subnet address range restrictions](./custom-virtual-networks.md).
29+
- Make sure the `Microsoft.Cdn` resource provider is registered for your subscription.
30+
1. Sign in to the [Azure portal](https://portal.azure.com).
31+
1. Go to your subscription page and select **Settings** > **Resource providers**.
32+
1. Select **Microsoft.Cdn** from the provider list.
33+
1. Select **Register**.
2634

2735
## Architecture
2836

29-
This guide focuses on the **workload profiles** environment type, which supports the combination of virtual network integration, private endpoints, and zone redundancy.
37+
The workload profiles environment type supports the combination of custom virtual network integration, private endpoints, and zone redundancy.
38+
39+
The following list describes how inbound traffic flows from the user to your container app:
40+
41+
1. A user connects to the Azure Front Door edge.
3042

31-
### Traffic flow
43+
1. Azure Front Door forwards traffic to the origin over Private Link.
3244

33-
1. A user connects to Azure Front Door (edge).
34-
2. Azure Front Door forwards traffic to the origin over Private Link.
35-
3. Traffic arrives at the private endpoint IP address in the workload virtual network (for example, `10.0.2.4`).
36-
4. The private endpoint connects to the internal Azure Container Apps environment.
37-
5. Within the virtual network, the environment uses an internal load balancer (ILB) virtual IP (for example, `10.0.0.165`) to reach the ingress controller.
38-
6. The ingress controller routes traffic to the correct container app, revision, and replica based on host headers and ingress configuration.
45+
1. Traffic arrives at the private endpoint IP address in the workload virtual network (for example, `10.0.2.4`).
46+
47+
1. The private endpoint connects to the internal Container Apps environment.
48+
49+
1. Within the virtual network, the environment uses an internal load balancer (ILB) VIP (for example, `10.0.0.165`) to reach the ingress controller.
50+
51+
1. The ingress controller routes traffic to the correct container app, revision, and replica based on host headers and ingress configuration.
3952

4053
### Design considerations
4154

42-
| Decision | Value | Reason |
43-
|----------|-------|--------|
44-
| Container Apps subnet size | /23 | Allows room for scaling. |
45-
| Front Door SKU | Premium | Required for Private Link support. |
55+
Keep the following design decisions in mind when you plan your deployment:
56+
57+
| Decision | Recommendation | Reason |
58+
|----------|----------------|--------|
59+
| Container Apps subnet size | `/23` | Provides room for scaling replicas and nodes. |
60+
| Private endpoint subnet | Separate, nondelegated subnet (for example, `/24`) | Private endpoints can't share a delegated subnet. |
61+
| Front Door SKU | Premium | Required for Private Link origins. |
62+
63+
## Create the virtual network and subnets
64+
65+
Create a virtual network with two subnets: one delegated to the Container Apps environment and one for private endpoints.
66+
67+
1. Search for **Virtual networks** in the top search bar.
68+
69+
1. Select **Virtual networks** in the search results.
70+
71+
1. Select **Create**.
72+
73+
1. In *Create virtual network*, in the *Basics* tab, enter the following values.
74+
75+
| Setting | Action |
76+
|---|---|
77+
| Subscription | Select your Azure subscription. |
78+
| Resource group | Select **Create new** and enter a name (for example, **my-container-apps**). |
79+
| Virtual network name | Enter a name (for example, **my-vnet**). |
80+
| Region | Select your target region. |
81+
82+
1. Select the **IP addresses** tab.
83+
84+
1. Configure the address space (for example, `10.0.0.0/16`).
85+
86+
1. Create two subnets with the following configuration:
87+
88+
| Subnet name | Address range | Delegation | Purpose |
89+
|---|---|---|---|
90+
| **container-apps-subnet** | For example, `10.0.0.0/23` | `Microsoft.App/environments` | Hosts the Container Apps environment. |
91+
| **private-endpoint-subnet** | For example, `10.0.2.0/24` | None | Hosts private endpoints. |
92+
93+
1. Select **Review + create**, and then select **Create**.
94+
95+
## Create the container app and environment
96+
97+
Create a Container Apps environment with internal ingress in your custom virtual network, and then deploy a container app to the environment.
98+
99+
### Create the container app
100+
101+
1. Search for **Container Apps** in the top search bar.
102+
103+
1. Select **Container Apps** in the search results.
104+
105+
1. Select **Create**.
106+
107+
1. In *Create Container App*, use the *Basics* tab to enter the following values.
108+
109+
| Setting | Action |
110+
|---|---|
111+
| Subscription | Select your Azure subscription. |
112+
| Resource group | Select the resource group you created (for example, **my-container-apps**). |
113+
| Container app name | Enter a name (for example, **my-container-app**). |
114+
| Deployment source | Select **Container image**. |
115+
| Region | Select the same region as your virtual network. |
116+
117+
1. In *Container Apps Environment*, select **Create new environment**.
118+
119+
### Configure the environment
120+
121+
1. In *Create Container Apps Environment*, in the *Basics* tab, enter the following values.
122+
123+
| Setting | Action |
124+
|---|---|
125+
| Environment name | Enter a name (for example, **my-environment**). |
126+
| Zone redundancy | Select **Enabled** (if available and required). |
127+
128+
1. Select the **Workload profiles** tab, and add at least one workload profile (for example, **D4**). Set the autoscaling instance count range.
129+
130+
1. Select the **Networking** tab and enter the following values.
131+
132+
| Setting | Action |
133+
|---|---|
134+
| Public network access | Select **Disable: Block all incoming traffic from the public internet**. |
135+
| Use your own virtual network | Select **Yes**. |
136+
| Virtual network | Select the virtual network you created (for example, **my-vnet**). |
137+
| Infrastructure subnet | Select the delegated subnet (for example, **container-apps-subnet**). |
138+
| Virtual IP | Select **Internal**. |
139+
| Enable private endpoints | Select **Yes**. |
140+
| Private endpoint subnet | Select **private-endpoint-subnet**. |
141+
| DNS | Select **Azure Private DNS zone**. |
142+
143+
1. Select **Create** to create the environment.
144+
145+
### Configure and deploy the container app
146+
147+
1. On *Create Container App*, select the **Container** tab.
148+
149+
1. Select **Use quickstart image** for testing, or clear the checkbox and provide your own container image.
150+
151+
> [!NOTE]
152+
> The quickstart image enables ingress automatically. If you don't use the quickstart image, make sure you enable ingress so that your container app can accept traffic from Azure Front Door through the private endpoint.
153+
154+
1. Select **Review + create**, and then select **Create**.
155+
156+
## Verify the environment deployment
157+
158+
Before you create the Azure Front Door profile, confirm that the environment is configured correctly.
159+
160+
1. Go to the resource group you created and open the **Container Apps environment** resource.
161+
162+
1. Select **Networking**.
163+
164+
1. Verify the following settings:
165+
166+
| Setting | Expected value |
167+
|---|---|
168+
| Public network access | **Disabled** |
169+
| Virtual IP | **Internal** (note the IP address) |
170+
| Private endpoint connections | At least one connection exists and is approved |
171+
172+
## Create the Azure Front Door Premium profile
173+
174+
Create an Azure Front Door Premium profile to route inbound traffic to your internal container app over Private Link.
175+
176+
1. Search for **Front Door and CDN profiles** in the top search bar.
177+
178+
1. Select **Front Door and CDN profiles** in the search results.
179+
180+
1. Select **Create**.
181+
182+
1. Select **Azure Front Door** and **Quick Create**.
183+
184+
1. Select the **Continue to create a Front Door** button.
185+
186+
1. In *Create a Front Door profile*, in the *Basics* tab, enter the following values.
187+
188+
| Setting | Action |
189+
|---|---|
190+
| Resource group | Select the resource group you created (for example, **my-container-apps**). |
191+
| Name | Enter a profile name (for example, **my-afd-profile**). |
192+
| Tier | Select **Premium**. Private Link isn't supported for origins on the Standard tier. |
193+
| Endpoint name | Enter an endpoint name (for example, **my-afd-endpoint**). |
194+
| Origin type | Select **Container Apps**. |
195+
| Origin host name | Select your container app environment. |
196+
| Enable private link service | Enable this setting. |
197+
| Region | Select the region of your container app. |
198+
| Target sub resource | Select **managedEnvironments**. |
199+
| Request message | Enter a message (for example, **AFD Private Link Request**). |
200+
201+
1. Select **Review + create**, and then select **Create**.
202+
203+
1. After the deployment finishes, select **Go to resource** and find your *Endpoint hostname*. Your hostname looks like the following example. Make a note of this hostname.
204+
205+
```text
206+
my-afd-endpoint.<HASH>.b01.azurefd.net
207+
```
208+
209+
## Approve the private endpoint connection
210+
211+
After you deploy Azure Front Door, approve the incoming private endpoint connection request from the Container Apps environment.
46212
47-
## Deployment procedure
213+
1. Go to the **Container Apps environment** resource in the Azure portal.
48214
49-
### 1. Create the virtual network and subnets
215+
1. Select **Settings** > **Networking**.
50216
51-
Create a virtual network with two subnets: one for the container apps environment and one for private endpoints.
217+
1. Select the link for private endpoint connection requests.
52218
53-
1. In the Azure portal, search for **Virtual networks** and select **Create**.
54-
2. Select your **Resource group** and enter a **Virtual network name**.
55-
3. Select the target **Region**.
56-
4. On the **IP addresses** tab, configure the address space (for example, `10.0.0.0/16`).
57-
5. Create two subnets:
58-
- **Container Apps subnet**: Delegate to `Microsoft.App/environments`. Size according to your scaling needs (for example, `/23`).
59-
- **Private Endpoint subnet**: Don't delegate. This subnet hosts private endpoints (for example, `/24`).
60-
6. Select **Review + create**, and then select **Create**.
219+
1. Select the pending connection with the description you provided (for example, **AFD Private Link Request**).
61220
62-
### 2. Create the container app and environment
221+
1. Select **Approve**.
63222
64-
1. Search for **Container Apps** in the portal and select **Create**.
65-
2. Choose your **Resource group** and enter a **Container app name**.
66-
3. For **Container Apps environment**, select **Create new**.
223+
1. Wait for the status to change to **Approved**.
67224
68-
#### Configure the environment
225+
> [!NOTE]
226+
> Azure Front Door has a known problem where it might create multiple private endpoint connection requests. Approve each request with the matching description.
69227
70-
1. On the **Basics** tab of the environment creation page:
71-
- Enter an **Environment name**.
72-
- Select the **Region**.
73-
- Enable **Zone redundancy** (if available and required).
74-
2. On the **Workload profiles** tab, add at least one profile (for example, **D4**). Set the autoscaling instance count range.
75-
3. On the **Networking** tab:
76-
- Set **Public network access** to **Disabled**.
77-
- Set **Use your own virtual network** to **Yes**.
78-
- Select the virtual network and the delegated **Container Apps subnet** you created.
79-
- Set **Virtual IP** to **Internal**.
80-
- Set **Private endpoints** to **Enabled**.
81-
- Select **Azure Private DNS zone** to automatically configure DNS.
82-
4. Select **Create** to create the environment.
228+
## Validate the connection
83229
84-
#### Configure the container app
230+
After you approve the private endpoint connection, verify that traffic reaches your container app through Azure Front Door.
85231
86-
1. On the **Create Container App** page, go to the **Container** tab.
87-
2. Uncheck **Use quickstart image** if you want to use your own image, or leave it checked for testing.
88-
3. Select **Review + create**, and then select **Create**.
232+
1. Browse to the Azure Front Door endpoint hostname you recorded earlier.
89233
90-
### 3. Verify deployment
234+
1. Verify that your application loads correctly.
91235
92-
1. Go to your resource group and verify the resources you created.
93-
2. Open the **Container Apps environment** resource.
94-
3. Go to **Networking**.
95-
4. Verify that **Public network access** is **Disabled**.
96-
5. Verify that **Virtual IP** is **Internal** and note the IP address.
97-
6. Verify that a **Private endpoint** connection exists and is approved (if created automatically).
236+
1. Confirm that direct access to the container app's default domain fails, since public access is disabled.
98237
99-
### 4. Create Azure Front Door Premium with Private Link
238+
1. Verify that DNS resolution for the environment domain resolves to the private IP address within the virtual network.
100239
101-
Create an Azure Front Door profile to securely access your internal container app.
240+
> [!NOTE]
241+
> Global deployment might take a few minutes to propagate. If you don't see the expected output, wait a few minutes and then refresh.
102242
103-
1. Search for **Azure Front Door and CDN profiles** and select **Create**.
104-
2. Select **Azure Front Door** and then **Quick create**.
105-
3. Select **Premium** as the SKU.
106-
4. Choose your **Resource group**.
107-
5. Enter a **Profile name** and **Endpoint name**.
108-
6. For **Origin type**, select **Container Apps**.
109-
7. In **Origin host name**, select your container app environment.
110-
8. Ensure **Private Link** is enabled.
111-
9. Select the **Region** of your container app.
112-
10. In **Private link approval message**, enter a message (for example, "Allow Front Door").
113-
11. Select **Review + create**, and then select **Create**.
243+
## Troubleshoot common problems
114244
115-
### 5. Approve the private endpoint connection
245+
The following table describes common problems and their resolutions:
116246
117-
After you deploy Azure Front Door, approve the private endpoint connection request.
247+
| Problem | Resolution |
248+
|---|---|
249+
| Subnet validation errors | Ensure the Container Apps subnet is delegated to `Microsoft.App/environments` and meets the [minimum size requirements](./custom-virtual-networks.md#subnet). |
250+
| Private endpoint creation failure | Ensure the private endpoint is in a separate, nondelegated subnet. |
251+
| Front Door origin returns an error | Verify that the private endpoint connection is approved in the Container Apps environment. It might take a few minutes for the connection to become active. |
252+
| Container app is publicly accessible | Verify that **Public network access** is set to **Disabled** in the Container Apps environment networking settings. |
118253
119-
1. Go to your **Container Apps environment** resource in the Azure portal.
120-
2. Select **Networking** > **Private endpoint connections**.
121-
3. Select the pending connection with the description you provided (for example, "Allow Front Door").
122-
4. Select **Approve**.
123-
5. Wait for the status to change to **Approved**.
254+
## Clean up resources
124255
125-
## Validation
256+
If you don't plan to continue using this application, you can delete the container app and all the associated services by removing the resource group.
126257
127-
1. Access the Azure Front Door endpoint URL from a browser or client.
128-
2. Verify that your application loads correctly.
129-
3. Confirm that direct access to the container app's default domain fails (since public access is disabled).
130-
4. Verify that DNS resolution for the environment domain resolves to the private IP address within the virtual network.
258+
1. Select your resource group from the *Overview* section.
259+
1. Select the **Delete resource group** button at the top of the resource group *Overview*.
260+
1. Enter the resource group name in the confirmation dialog.
261+
1. Select **Delete**.
131262
132-
## Troubleshooting
263+
The process to delete the resource group can take a few minutes.
133264
134-
- **Subnet validation errors**: Ensure the Container Apps subnet is delegated to `Microsoft.App/environments` and meets size requirements.
135-
- **Private endpoint failure**: Ensure the private endpoint is in a separate, nondelegated subnet.
136-
- **Front Door origin error**: Check that the private endpoint connection is approved in the Container Apps environment. It might take a few minutes for the connection to be established.
137-
- **Public access still works**: Verify that **Public network access** is set to **Disabled** in the Container Apps environment networking settings.
265+
> [!TIP]
266+
> Having problems? Let us know on GitHub by opening an issue in the [Azure Container Apps repo](https://github.com/microsoft/azure-container-apps).
138267
139-
## Next steps
268+
## Related content
140269
141270
- [Networking in Azure Container Apps](./networking.md)
142-
- [Private endpoints](./how-to-use-private-endpoint.md)
271+
- [Use a private endpoint with an Azure Container Apps environment](./how-to-use-private-endpoint.md)
272+
- [Create a private link to an Azure Container App with Azure Front Door](./how-to-integrate-with-azure-front-door.md)
273+
- [Virtual network configuration](./custom-virtual-networks.md)
274+
- [Private endpoints and DNS](./private-endpoints-with-dns.md)

0 commit comments

Comments
 (0)