Access an app in Azure Spring Apps in a virtual network

Use the following steps to create a private DNS zone for an application in the private network:

1. Open the Azure portal. Using the search box, search for Private DNS zones. Select Private DNS zones from the search results.

2. On the Private DNS zones page, select Add.

3. Fill out the form on the Create Private DNS zone page. For Name, enter private.microservices.azure.cn.

4. Select Review + Create.

5. Select Create.

Use the following command to create the private DNS zone:

az network private-dns zone create \
    --resource-group $RESOURCE_GROUP \
    --name private.microservices.azure.cn

Use the following steps to grant permission:

1. Select the private DNS zone resource you created - for example, private.microservices.azure.cn.

2. Select Access control (IAM), and then select Add > Add role assignment.

   

3. Assign the Private DNS Zone Contributor role to the Azure Spring Apps Resource Provider. For more information, see Assign Azure roles using the Azure portal.

   Note

   If you don't find Azure Spring Apps Resource Provider, search for Azure Spring Cloud Resource Provider.

   

Use the following commands to grant permission:

export PRIVATE_DNS_ZONE_RESOURCE_ID=$(az network private-dns zone show \
    --resource-group $RESOURCE_GROUP \
    --name $PRIVATE_DNS_ZONE_NAME \
    --query "id" \
    --output tsv)

az role assignment create \
    --role "Private DNS Zone Contributor" \
    --scope ${PRIVATE_DNS_ZONE_RESOURCE_ID} \
    --assignee e8de9221-a19c-4c81-b814-fd37c6caf9d2

The --assignee argument represents the service principal Azure Spring Apps uses to interact with the customer's private DNS zone.

Use the following steps to find the IP address for your application:

1. Go to the Azure Spring Apps service Networking page.

2. Select the Vnet injection tab.

3. In the General info section, find Endpoint and copy the IP Address value. The example in the following screenshot uses the IP address 10.0.1.6:

   

Use the following steps to initialize the local environment and find the IP address for your application.

1. Use the following commands to define various environment variables. Be sure to replace the placeholders with your actual values.

   export SUBSCRIPTION='<subscription-ID>'
   export RESOURCE_GROUP='<resource-group-name>'
   export AZURE_SPRING_APPS_INSTANCE_NAME='<Azure-Spring-Apps-instance-name>'
   export VIRTUAL_NETWORK_NAME='<Azure-Spring-Apps-virtual-network-name>'
   export APP_NAME='<application-name>'
   

2. Use the following commands to sign in to the Azure CLI and choose your active subscription:

   az login
   az account set --subscription ${SUBSCRIPTION}
   

3. Use the following commands to find the IP address for your application.

   export SERVICE_RUNTIME_RG=$(az spring show \
       --resource-group $RESOURCE_GROUP \
       --name $AZURE_SPRING_APPS_INSTANCE_NAME \
       --query "properties.networkProfile.serviceRuntimeNetworkResourceGroup" \
       --output tsv)
   export IP_ADDRESS=$(az network lb frontend-ip list \
       --lb-name kubernetes-internal \
       --resource-group $SERVICE_RUNTIME_RG \
       --query "[0].privateIPAddress" \
       --output tsv)
   echo $IP_ADDRESS
   

Use the following steps to use the private DNS zone to translate/resolve DNS:

1. Select the private DNS zone resource you created - for example, private.microservices.azure.cn.

2. Select Record set.

3. In Add record set, enter or select the following information:

   Setting	Value
   Name	Enter *.
   Type	Select A.
   TTL	Enter 1.
   TTL unit	Select Hours.
   IP address	Enter the IP address. The following screenshot uses the IP address 10.1.0.7.

   

4. Select OK.

Use the following command to create the "A" record in your DNS zone:

az network private-dns record-set a add-record \
    --resource-group $RESOURCE_GROUP \
    --zone-name private.microservices.azure.cn \
    --record-set-name '*' \
    --ipv4-address $IP_ADDRESS

Use the following steps to link the private DNS zone you created to the virtual network holding your Azure Spring Apps service:

1. Select the private DNS zone resource you created - for example, private.microservices.azure.cn.

2. Select Virtual network links, and then select Add.

3. For Link name, enter azure-spring-apps-dns-link.

4. For Virtual network, select the virtual network you created previously.

   

5. Select OK.

Use the following command to link the private DNS zone you created to the virtual network holding your Azure Spring Apps service:

az network private-dns link vnet create \
    --resource-group $RESOURCE_GROUP \
    --name azure-spring-apps-dns-link \
    --zone-name private.microservices.azure.cn \
    --virtual-network $VIRTUAL_NETWORK_NAME \
    --registration-enabled false

Use the following steps to assign a private FQDN:

1. Select the Azure Spring Apps service instance deployed in your virtual network, and open the Apps tab.

2. Select the application to open the Overview page.

3. Select Assign Endpoint to assign a private FQDN to your application. Assigning an FQDN can take a few minutes.

   

4. The assigned private FQDN (labeled URL) is now available. You can only access the URL within the private network, but not on the internet.

Use the following command to assign an endpoint to your application:

az spring app update \
    --resource-group $RESOURCE_GROUP \
    --name $APP_NAME \
    --service $AZURE_SPRING_APPS_INSTANCE_NAME \
    --assign-endpoint true