Private endpoint support for container apps #2322

pamelafox · 2025-02-03T22:24:50Z

Purpose

This PR adds private networking support for Azure Container Apps, plus a P2S VPN Gateway with Azure Private DNS resolver for local development inside the virtual network.

Does this introduce a breaking change?

When developers merge from main and run the server, azd up, or azd deploy, will this produce an error?
If you're not sure, try it out on an old environment.

[ ] Yes
[X] No

Does this require changes to learn.microsoft.com docs?

This repository is referenced by this tutorial
which includes deployment, settings and usage instructions. If text or screenshot need to change in the tutorial,
check the box below and notify the tutorial author. A Microsoft employee can do this for you if you're an external contributor.

[ ] Yes
[X] No

Type of change

[ ] Bugfix
[X] Feature
[ ] Code style update (formatting, local variables)
[ ] Refactoring (no functional changes, no api changes)
[ ] Documentation content changes
[ ] Other... Please describe:

Code quality checklist

See CONTRIBUTING.md for more details.

The current tests all pass (python -m pytest).
I added tests that prove my fix is effective or that my feature works
I ran python -m pytest --cov to verify 100% coverage of added lines
I ran python -m mypy to check for type errors
I either used the pre-commit hooks or ran ruff and black manually on my code.

…ai-demo

pamelafox · 2025-02-06T00:45:44Z

Blocking: Azure/bicep-registry-modules#4387

faaraan-farid-kazi · 2025-07-20T22:50:13Z

Request to Make Existing Container Private Post Deployment

Hi Pamela,

We are currently facing an issue regarding the privacy of our deployed container. Our organization requires that this container be private due to internal policy and data sensitivity concerns.

Current Status:

The application is already deployed and actively used by approximately 1,200 users.
A significant amount of data has already been uploaded and is in use.

Requirement:

We need a solution that allows us to make the existing container private without disrupting the current deployment or user access.

Open Questions:

Is there a way to retroactively apply privacy settings to the existing container?
Would migrating to App Services provide a more secure or manageable solution for our use case?

We would appreciate guidance on the best approach to achieve this while minimizing impact on our users and data.

Thanks,
Faaraan

github-actions · 2025-07-30T06:31:00Z

Check Broken URLs

We have automatically detected the following broken URLs in your files. Review and fix the paths to resolve this issue.

Check the file paths and associated broken URLs inside them.
For more details, check our Contributing Guide.

File Full Path Issues

docs/deploy_private.md

#	Link	Line Number
1	`https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-vpn-client-install`	`82`

github-actions · 2025-07-30T06:33:01Z

Check Broken URLs

We have automatically detected the following broken URLs in your files. Review and fix the paths to resolve this issue.

Check the file paths and associated broken URLs inside them.
For more details, check our Contributing Guide.

File Full Path Issues

docs/deploy_private.md

#	Link	Line Number
1	`https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-howto-vpn-client-install`	`82`

…h-openai-demo into acaprivate

Copilot

Pull Request Overview

This PR adds private networking support for Azure Container Apps, enabling deployment with private endpoints and optional VPN gateway configuration for secure access. The changes primarily focus on extending the existing private endpoint functionality from App Service to Container Apps and adding VPN gateway support for local development access.

Extends private endpoint support to Container Apps deployment target
Adds P2S VPN Gateway with Azure Private DNS resolver for secure local development access
Refactors network isolation infrastructure to support both App Service and Container Apps with consistent subnet management

Reviewed Changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
infra/private-endpoints.bicep	Updates parameter naming from subnet name to subnet ID and improves DNS zone naming
infra/network-isolation.bicep	Major refactor to support Container Apps with NSGs, VPN gateway, and DNS resolver
infra/main.parameters.json	Adds VPN gateway parameter and removes deprecated Container Apps workload profile
infra/main.bicep	Extends private endpoint logic to Container Apps and adds VPN gateway configuration
infra/core/storage/storage-account.bicep	Minor syntax update using null coalescing operator
infra/core/host/container-registry.bicep	New module for Container Registry with VNet integration support
infra/core/host/container-apps.bicep	Simplified Container Apps module with better parameter handling
infra/core/host/container-apps-environment.bicep	New dedicated module for Container Apps environment configuration
infra/core/host/container-app.bicep	Removes deprecated workload profile parameter
infra/core/host/container-app-upsert.bicep	Removes deprecated workload profile parameter
infra/abbreviations.json	Adds abbreviation for private DNS resolver
docs/deploy_private.md	Updated deployment instructions for VPN gateway usage
app/backend/prepdocs.py	Adds connectivity check for search service with VPN guidance

Comments suppressed due to low confidence (1)

infra/core/host/container-apps-environment.bicep:13

The API version '2025-02-02-preview' appears to be from the future. As of my knowledge cutoff in January 2025, this version may not exist. Consider using a stable API version like '2024-03-01' or verify that this preview version is available.

resource containerAppsEnvironment 'Microsoft.App/managedEnvironments@2025-02-02-preview' = {

infra/network-isolation.bicep

Copilot · 2025-07-31T05:59:13Z

infra/main.bicep

@@ -1352,3 +1375,5 @@ output BACKEND_URI string = deploymentTarget == 'appservice' ? backend.outputs.u
 output AZURE_CONTAINER_REGISTRY_ENDPOINT string = deploymentTarget == 'containerapps'
  ? containerApps.outputs.registryLoginServer
  : ''
+
+  output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''


This line has inconsistent indentation - it appears to have extra leading spaces compared to the previous output statement.

Suggested change

output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''

output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''

app/backend/prepdocs.py

docs/deploy_private.md

infra/core/host/container-app.bicep

mattgotteiner · 2025-07-31T18:52:01Z

infra/main.bicep

@@ -1352,3 +1375,5 @@ output BACKEND_URI string = deploymentTarget == 'appservice' ? backend.outputs.u
 output AZURE_CONTAINER_REGISTRY_ENDPOINT string = deploymentTarget == 'containerapps'
  ? containerApps.outputs.registryLoginServer
  : ''
+
+output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''


virtual network gateway resource id

infra/network-isolation.bicep

mattgotteiner · 2025-08-02T00:31:56Z

infra/core/host/container-apps-environment.bicep

+
+param usePrivateIngress bool = true
+
+@allowed(['Consumption', 'D4', 'D8', 'D16', 'D32', 'E4', 'E8', 'E16', 'E32', 'NC24-A100', 'NC48-A100', 'NC96-A100'])


mattgotteiner

Thanks for your efforts here

pamelafox added 6 commits January 7, 2025 12:47

Configure Azure Developer Pipeline

6fac970

Merge branch 'main' of https://github.com/pamelafox/azure-search-open…

adf0353

…ai-demo

Merge branch 'main' of https://github.com/pamelafox/azure-search-open…

402e818

…ai-demo

Merge branch 'main' of https://github.com/pamelafox/azure-search-open…

f33af14

…ai-demo

Private endpoints draft

b16fd31

Conditional for SPL

7ad962a

pamelafox added 3 commits February 5, 2025 16:47

private endpoint for ACA

7a82bde

Merge branch 'main' into acaprivate

ee758e5

Add P2S VPN gateway and other improvements

0f18906

pamelafox added 8 commits July 22, 2025 10:28

Merge branch 'main' into acaprivate

b754767

Private endpoint almost working

ced5983

Usving avm for the subnets

abb00aa

Connected app to vnet

4b3eb2a

Feedback from Matt

ba69870

Move resources into modules

eac9f9d

Bring back unneeded changes

4b3cd8c

Update prepdocs with ping and update docs

7c0147a

pamelafox marked this pull request as ready for review July 30, 2025 06:31

pamelafox requested a review from Copilot July 30, 2025 06:31

Merge branch 'main' into acaprivate

bbd145a

This comment was marked as outdated.

Sign in to view

Fix VPN client link

d1f1de8

pamelafox added 4 commits July 29, 2025 23:33

Merge branch 'acaprivate' of https://github.com/pamelafox/azure-searc…

ebecb05

…h-openai-demo into acaprivate

Add App Service private endpoint for deployment

5a92db1

Revert unneeded bicep changes

d7f070b

Revert unneeded changes

0d0abb0

pamelafox changed the title ~~Draft PR: Private endpoint support for container apps~~ Private endpoint support for container apps Jul 30, 2025

pamelafox added 2 commits July 30, 2025 17:02

Remove unneeded NSG rules

8aaf0c0

Address feedback from Copilot

fc628e4

pamelafox requested a review from Copilot July 31, 2025 00:32

This comment was marked as outdated.

Sign in to view

Address feedback from Copilot

a426a3a

pamelafox requested review from Copilot, mattgotteiner and tonybaloney July 31, 2025 05:57

Copilot AI reviewed Jul 31, 2025

View reviewed changes

Address Copilot feedback

a46875b

mattgotteiner reviewed Jul 31, 2025

View reviewed changes

infra/core/host/container-app.bicep Show resolved Hide resolved

mattgotteiner reviewed Jul 31, 2025

View reviewed changes

infra/network-isolation.bicep Show resolved Hide resolved

pamelafox added 4 commits August 1, 2025 09:29

Update NSG, container registry

287aa0e

Update NSG, container registry

c2509d0

Address feedback

ee8a447

Bring back workload profile name

6ec8a2f

vhvb1989 approved these changes Aug 2, 2025

View reviewed changes

mattgotteiner reviewed Aug 2, 2025

View reviewed changes

mattgotteiner approved these changes Aug 2, 2025

View reviewed changes

pamelafox added 2 commits August 1, 2025 18:41

Merge branch 'main' into acaprivate

4dc3570

Merge branch 'main' into acaprivate

c429d92

pamelafox merged commit 8f998ed into Azure-Samples:main Aug 4, 2025
28 checks passed

This was referenced Aug 4, 2025

Fix code scanning alert - Virtual network (VNET) subnets should have Network Security Groups (NSGs) assigned. #1692

Closed

VNet security improvements #1691

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Private endpoint support for container apps #2322

Private endpoint support for container apps #2322

Uh oh!

pamelafox commented Feb 3, 2025 •

edited

Loading

Uh oh!

pamelafox commented Feb 6, 2025

Uh oh!

faaraan-farid-kazi commented Jul 20, 2025

Uh oh!

github-actions bot commented Jul 30, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Jul 30, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jul 31, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mattgotteiner Jul 31, 2025

Uh oh!

Uh oh!

mattgotteiner Aug 2, 2025

Uh oh!

mattgotteiner left a comment

Uh oh!

Uh oh!

Uh oh!

	output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''
	output AZURE_VPN_CONFIG_DOWNLOAD_LINK string = useVpnGateway ? 'https://portal.azure.com/#@${tenant().tenantId}/resource/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup.name}/providers/Microsoft.Network/virtualNetworkGateways/${isolation.outputs.virtualNetworkGatewayName}/pointtositeconfiguration' : ''


		param usePrivateIngress bool = true

		@allowed(['Consumption', 'D4', 'D8', 'D16', 'D32', 'E4', 'E8', 'E16', 'E32', 'NC24-A100', 'NC48-A100', 'NC96-A100'])

Private endpoint support for container apps #2322

Private endpoint support for container apps #2322

Uh oh!

Conversation

pamelafox commented Feb 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Does this introduce a breaking change?

Does this require changes to learn.microsoft.com docs?

Type of change

Code quality checklist

Uh oh!

pamelafox commented Feb 6, 2025

Uh oh!

faaraan-farid-kazi commented Jul 20, 2025

Request to Make Existing Container Private Post Deployment

Current Status:

Requirement:

Open Questions:

Uh oh!

github-actions bot commented Jul 30, 2025

Check Broken URLs

Uh oh!

This comment was marked as outdated.

Uh oh!

github-actions bot commented Jul 30, 2025

Check Broken URLs

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Copilot AI Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mattgotteiner Jul 31, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mattgotteiner Aug 2, 2025

Choose a reason for hiding this comment

Uh oh!

mattgotteiner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

pamelafox commented Feb 3, 2025 •

edited

Loading