Skip to content

Commit fc86cfe

Browse files
JillGrant615JillGrant615
authored
Merge pull request #312680 from craigshoemaker/aca/kumar/private-link
[Container Apps] New: Azure Front Door premium using private link
2 parents 537724a + abefd4c commit fc86cfe

2 files changed

Lines changed: 276 additions & 0 deletions

File tree

‎articles/container-apps/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,8 @@ items:
470470
href: mtls.md
471471
- name: Integrate with Azure Front Door
472472
href: how-to-integrate-with-azure-front-door.md
473+
- name: Use Azure Front Door and Private Link
474+
href: front-door-custom-virtual-network-private-link.md
473475
- name: Languages and runtimes
474476
items:
475477
- name: .NET

‎articles/container-apps/front-door-custom-virtual-network-private-link.md‎

Lines changed: 274 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,274 @@
1+
---
2+
title: Use Azure Front Door Premium with a custom virtual network and Private Link in Azure Container Apps
3+
description: Learn how to deploy an Azure Container Apps environment in a custom virtual network with internal ingress and expose it securely through Azure Front Door Premium with Private Link.
4+
#customer intent: As a cloud architect, I want to deploy Azure Container Apps in a secure custom virtual network so that I can route inbound traffic privately through Azure Front Door Premium with Private Link.
5+
author: kkaushal24011982
6+
ms.author: kkaushal
7+
ms.reviewer: cshoe
8+
ms.service: azure-container-apps
9+
ms.custom:
10+
- build-2025
11+
ms.topic: how-to
12+
ms.date: 03/05/2026
13+
---
14+
15+
# Use Azure Front Door Premium with a custom virtual network and Private Link
16+
17+
In this article, you learn how to deploy an Azure Container Apps environment in a custom virtual network with an internal virtual IP (VIP) and public network access disabled. You then expose the environment securely through Azure Front Door Premium by using Private Link and private endpoints. This configuration provides a secure inbound path to your container apps while supporting zone redundancy.
18+
19+
> [!IMPORTANT]
20+
> There are [more charges](./private-endpoints-with-dns.md#billing) for enabling private endpoints in both the Dedicated and Consumption plans.
21+
22+
## Prerequisites
23+
24+
- Azure account with an active subscription.
25+
- If you don't have one, [create one for free](https://azure.microsoft.com/pricing/purchase-options/azure-account?cid=msft_learn).
26+
27+
- This feature only supports workload profile environments.
28+
29+
- Make sure the `Microsoft.Cdn` resource provider is registered for your subscription.
30+
1. Sign in to the [Azure portal](https://portal.azure.com).
31+
1. Go to your subscription page and select **Settings** > **Resource providers**.
32+
1. Select **Microsoft.Cdn** from the provider list.
33+
1. Select **Register**.
34+
35+
## Architecture
36+
37+
The workload profiles environment type supports the combination of custom virtual network integration, private endpoints, and zone redundancy.
38+
39+
The following list describes how inbound traffic flows from the user to your container app:
40+
41+
1. A user connects to the Azure Front Door edge.
42+
43+
1. Azure Front Door forwards traffic to the origin over Private Link.
44+
45+
1. Traffic arrives at the private endpoint IP address in the workload virtual network (for example, `10.0.2.4`).
46+
47+
1. The private endpoint connects to the internal Container Apps environment.
48+
49+
1. Within the virtual network, the environment uses an internal load balancer (ILB) VIP (for example, `10.0.0.165`) to reach the ingress controller.
50+
51+
1. The ingress controller routes traffic to the correct container app, revision, and replica based on host headers and ingress configuration.
52+
53+
### Design considerations
54+
55+
Keep the following design decisions in mind when you plan your deployment:
56+
57+
| Decision | Recommendation | Reason |
58+
|----------|----------------|--------|
59+
| Container Apps subnet size | `/23` | Provides room for scaling replicas and nodes. |
60+
| Private endpoint subnet | Separate, nondelegated subnet (for example, `/24`) | Private endpoints can't share a delegated subnet. |
61+
| Front Door SKU | Premium | Required for Private Link origins. |
62+
63+
## Create the virtual network and subnets
64+
65+
Create a virtual network with two subnets: one delegated to the Container Apps environment and one for private endpoints.
66+
67+
1. Search for **Virtual networks** in the top search bar.
68+
69+
1. Select **Virtual networks** in the search results.
70+
71+
1. Select **Create**.
72+
73+
1. In *Create virtual network*, in the *Basics* tab, enter the following values.
74+
75+
| Setting | Action |
76+
|---|---|
77+
| Subscription | Select your Azure subscription. |
78+
| Resource group | Select **Create new** and enter a name (for example, **my-container-apps**). |
79+
| Virtual network name | Enter a name (for example, **my-vnet**). |
80+
| Region | Select your target region. |
81+
82+
1. Select the **IP addresses** tab.
83+
84+
1. Configure the address space (for example, `10.0.0.0/16`).
85+
86+
1. Create two subnets with the following configuration:
87+
88+
| Subnet name | Address range | Delegation | Purpose |
89+
|---|---|---|---|
90+
| **container-apps-subnet** | For example, `10.0.0.0/23` | `Microsoft.App/environments` | Hosts the Container Apps environment. |
91+
| **private-endpoint-subnet** | For example, `10.0.2.0/24` | None | Hosts private endpoints. |
92+
93+
1. Select **Review + create**, and then select **Create**.
94+
95+
## Create the container app and environment
96+
97+
Create a Container Apps environment with internal ingress in your custom virtual network, and then deploy a container app to the environment.
98+
99+
### Create the container app
100+
101+
1. Search for **Container Apps** in the top search bar.
102+
103+
1. Select **Container Apps** in the search results.
104+
105+
1. Select **Create**.
106+
107+
1. In *Create Container App*, use the *Basics* tab to enter the following values.
108+
109+
| Setting | Action |
110+
|---|---|
111+
| Subscription | Select your Azure subscription. |
112+
| Resource group | Select the resource group you created (for example, **my-container-apps**). |
113+
| Container app name | Enter a name (for example, **my-container-app**). |
114+
| Deployment source | Select **Container image**. |
115+
| Region | Select the same region as your virtual network. |
116+
117+
1. In *Container Apps Environment*, select **Create new environment**.
118+
119+
### Configure the environment
120+
121+
1. In *Create Container Apps Environment*, in the *Basics* tab, enter the following values.
122+
123+
| Setting | Action |
124+
|---|---|
125+
| Environment name | Enter a name (for example, **my-environment**). |
126+
| Zone redundancy | Select **Enabled** (if available and required). |
127+
128+
1. Select the **Workload profiles** tab, and add at least one workload profile (for example, **D4**). Set the autoscaling instance count range.
129+
130+
1. Select the **Networking** tab and enter the following values.
131+
132+
| Setting | Action |
133+
|---|---|
134+
| Public network access | Select **Disable: Block all incoming traffic from the public internet**. |
135+
| Use your own virtual network | Select **Yes**. |
136+
| Virtual network | Select the virtual network you created (for example, **my-vnet**). |
137+
| Infrastructure subnet | Select the delegated subnet (for example, **container-apps-subnet**). |
138+
| Virtual IP | Select **Internal**. |
139+
| Enable private endpoints | Select **Yes**. |
140+
| Private endpoint subnet | Select **private-endpoint-subnet**. |
141+
| DNS | Select **Azure Private DNS zone**. |
142+
143+
1. Select **Create** to create the environment.
144+
145+
### Configure and deploy the container app
146+
147+
1. On *Create Container App*, select the **Container** tab.
148+
149+
1. Select **Use quickstart image** for testing, or clear the checkbox and provide your own container image.
150+
151+
> [!NOTE]
152+
> The quickstart image enables ingress automatically. If you don't use the quickstart image, make sure you enable ingress so that your container app can accept traffic from Azure Front Door through the private endpoint.
153+
154+
1. Select **Review + create**, and then select **Create**.
155+
156+
## Verify the environment deployment
157+
158+
Before you create the Azure Front Door profile, confirm that the environment is configured correctly.
159+
160+
1. Go to the resource group you created and open the **Container Apps environment** resource.
161+
162+
1. Select **Networking**.
163+
164+
1. Verify the following settings:
165+
166+
| Setting | Expected value |
167+
|---|---|
168+
| Public network access | **Disabled** |
169+
| Virtual IP | **Internal** (note the IP address) |
170+
| Private endpoint connections | At least one connection exists and is approved |
171+
172+
## Create the Azure Front Door Premium profile
173+
174+
Create an Azure Front Door Premium profile to route inbound traffic to your internal container app over Private Link.
175+
176+
1. Search for **Front Door and CDN profiles** in the top search bar.
177+
178+
1. Select **Front Door and CDN profiles** in the search results.
179+
180+
1. Select **Create**.
181+
182+
1. Select **Azure Front Door** and **Quick Create**.
183+
184+
1. Select the **Continue to create a Front Door** button.
185+
186+
1. In *Create a Front Door profile*, in the *Basics* tab, enter the following values.
187+
188+
| Setting | Action |
189+
|---|---|
190+
| Resource group | Select the resource group you created (for example, **my-container-apps**). |
191+
| Name | Enter a profile name (for example, **my-afd-profile**). |
192+
| Tier | Select **Premium**. Private Link isn't supported for origins on the Standard tier. |
193+
| Endpoint name | Enter an endpoint name (for example, **my-afd-endpoint**). |
194+
| Origin type | Select **Container Apps**. |
195+
| Origin host name | Select your container app environment. |
196+
| Enable private link service | Enable this setting. |
197+
| Region | Select the region of your container app. |
198+
| Target sub resource | Select **managedEnvironments**. |
199+
| Request message | Enter a message (for example, **AFD Private Link Request**). |
200+
201+
1. Select **Review + create**, and then select **Create**.
202+
203+
1. After the deployment finishes, select **Go to resource** and find your *Endpoint hostname*. Your hostname looks like the following example. Make a note of this hostname.
204+
205+
```text
206+
my-afd-endpoint.<HASH>.b01.azurefd.net
207+
```
208+
209+
## Approve the private endpoint connection
210+
211+
After you deploy Azure Front Door, approve the incoming private endpoint connection request from the Container Apps environment.
212+
213+
1. Go to the **Container Apps environment** resource in the Azure portal.
214+
215+
1. Select **Settings** > **Networking**.
216+
217+
1. Select the link for private endpoint connection requests.
218+
219+
1. Select the pending connection with the description you provided (for example, **AFD Private Link Request**).
220+
221+
1. Select **Approve**.
222+
223+
1. Wait for the status to change to **Approved**.
224+
225+
> [!NOTE]
226+
> Azure Front Door has a known problem where it might create multiple private endpoint connection requests. Approve each request with the matching description.
227+
228+
## Validate the connection
229+
230+
After you approve the private endpoint connection, verify that traffic reaches your container app through Azure Front Door.
231+
232+
1. Browse to the Azure Front Door endpoint hostname you recorded earlier.
233+
234+
1. Verify that your application loads correctly.
235+
236+
1. Confirm that direct access to the container app's default domain fails, since public access is disabled.
237+
238+
1. Verify that DNS resolution for the environment domain resolves to the private IP address within the virtual network.
239+
240+
> [!NOTE]
241+
> Global deployment might take a few minutes to propagate. If you don't see the expected output, wait a few minutes and then refresh.
242+
243+
## Troubleshoot common problems
244+
245+
The following table describes common problems and their resolutions:
246+
247+
| Problem | Resolution |
248+
|---|---|
249+
| Subnet validation errors | Ensure the Container Apps subnet is delegated to `Microsoft.App/environments` and meets the [minimum size requirements](./custom-virtual-networks.md#subnet). |
250+
| Private endpoint creation failure | Ensure the private endpoint is in a separate, nondelegated subnet. |
251+
| Front Door origin returns an error | Verify that the private endpoint connection is approved in the Container Apps environment. It might take a few minutes for the connection to become active. |
252+
| Container app is publicly accessible | Verify that **Public network access** is set to **Disabled** in the Container Apps environment networking settings. |
253+
254+
## Clean up resources
255+
256+
If you don't plan to continue using this application, you can delete the container app and all the associated services by removing the resource group.
257+
258+
1. Select your resource group from the *Overview* section.
259+
1. Select the **Delete resource group** button at the top of the resource group *Overview*.
260+
1. Enter the resource group name in the confirmation dialog.
261+
1. Select **Delete**.
262+
263+
The process to delete the resource group can take a few minutes.
264+
265+
> [!TIP]
266+
> Having problems? Let us know on GitHub by opening an issue in the [Azure Container Apps repo](https://github.com/microsoft/azure-container-apps).
267+
268+
## Related content
269+
270+
- [Networking in Azure Container Apps](./networking.md)
271+
- [Use a private endpoint with an Azure Container Apps environment](./how-to-use-private-endpoint.md)
272+
- [Create a private link to an Azure Container App with Azure Front Door](./how-to-integrate-with-azure-front-door.md)
273+
- [Virtual network configuration](./custom-virtual-networks.md)
274+
- [Private endpoints and DNS](./private-endpoints-with-dns.md)

0 commit comments

Comments
 (0)