公开容器组的静态 IP 地址Expose a static IP address for a container group

本文介绍一种使用 Azure 应用程序网关公开容器组的静态公共 IP 地址的方法。This article shows one way to expose a static, public IP address for a container group by using an Azure application gateway. 如果需要在 Azure 容器实例中运行的某个面向外部的容器化应用的静态入口点,请按这些步骤操作。Follow these steps when you need a static entry point for an external-facing containerized app that runs in Azure Container Instances.

本文使用 Azure CLI 为此方案创建资源:In this article you use the Azure CLI to create the resources for this scenario:

  • Azure 虚拟网络An Azure virtual network
  • 部署在虚拟网络中的一个容器组,其中托管了一个小型 Web 应用A container group deployed in the virtual network that hosts a small web app
  • 一个使用公共前端 IP 地址的应用程序网关、一个用于在网关上托管网站的侦听器,以及一个用于连接后端容器组的路由An application gateway with a public frontend IP address, a listener to host a website on the gateway, and a route to the backend container group

只要应用程序网关运行,并且容器组公开网络委托子网中的某个稳定专用 IP 地址,就可以通过此公共 IP 地址访问该容器组。As long as the application gateway runs and the container group exposes a stable private IP address in the network's delegated subnet, the container group is accessible at this public IP address.

备注

Azure 根据为网关预配的及可用时间的时间长短及其处理的数据量对应用程序网关进行收费。Azure charges for an application gateway based on the amount of time that the gateway is provisioned and available, as well as the amount of data it processes. 请参阅定价See pricing.

创建虚拟网络Create virtual network

在典型案例中,你可能已有一个 Azure 虚拟网络。In a typical case, you might already have an Azure virtual network. 如果没有,请按以下示例命令所示创建一个。If you don't have one, create one as shown with the following example commands. 该虚拟网络需要为应用程序网关和容器组提供单独的子网。The virtual network needs separate subnets for the application gateway and the container group.

如果需要,请创建一个 Azure 资源组。If you need one, create an Azure resource group. 例如:For example:

az group create --name myResourceGroup --location chinaeast2

使用 az network vnet create 命令创建虚拟网络。Create a virtual network with the az network vnet create command. 此命令在网络中创建 myAGSubnet 子网。This command creates the myAGSubnet subnet in the network.

az network vnet create \
  --name myVNet \
  --resource-group myResourceGroup \
  --location chinaeast2 \
  --address-prefix 10.0.0.0/16 \
  --subnet-name myAGSubnet \
  --subnet-prefix 10.0.1.0/24

使用 az network vnet subnet create 命令为后端容器组创建子网。Use the az network vnet subnet create command to create a subnet for the backend container group. 该子网在这里命名为 myACISubnetHere it's named myACISubnet.

az network vnet subnet create \
  --name myACISubnet \
  --resource-group myResourceGroup \
  --vnet-name myVNet   \
  --address-prefix 10.0.2.0/24

使用 az network public-ip create 命令创建静态公共 IP 资源。Use the az network public-ip create command to create a static public IP resource. 稍后的某个步骤会将此地址配置为应用程序网关的前端。In a later step, this address is configured as the front end of the application gateway.

az network public-ip create \
  --resource-group myResourceGroup \
  --name myAGPublicIPAddress \
  --allocation-method Static \
  --sku Standard

创建容器组Create container group

运行以下 az container create 命令,在上一步配置的虚拟网络中创建一个容器组。Run the following az container create to create a container group in the virtual network you configured in the previous step.

该组会部署到 myACISubnet 子网中,包含用于拉取 aci-helloworld 映像的名为 appcontainer 的单个实例。The group is deployed in the myACISubnet subnet and contains a single instance named appcontainer that pulls the aci-helloworld image. 如本文档中的其他文章所述,此映像会打包一个以 Node.js 编写的、可提供静态 HTML 页面的小型 Web 应用。As shown in other articles in the documentation, this image packages a small web app written in Node.js that serves a static HTML page.

az container create \
  --name appcontainer \
  --resource-group myResourceGroup \
  --image mcr.microsoft.com/azuredocs/aci-helloworld \
  --vnet myVNet \
  --subnet myACISubnet

成功部署后,将为该容器组分配虚拟网络中的某个专用 IP 地址。When successfully deployed, the container group is assigned a private IP address in the virtual network. 例如,运行以下 az container show 命令可以检索该组的 IP 地址:For example, run the following az container show command to retrieve the group's IP address:

az container show \
  --name appcontainer --resource-group myResourceGroup \
  --query ipAddress.ip --output tsv

输出类似于:10.0.2.4Output is similar to: 10.0.2.4.

请将该 IP 地址保存到环境变量中,以便在稍后的步骤中使用:For use in a later step, save the IP address in an environment variable:

ACI_IP=$(az container show \
  --name appcontainer \
  --resource-group myResourceGroup \
  --query ipAddress.ip --output tsv)

创建应用程序网关Create application gateway

按照应用程序网关快速入门中的步骤,在虚拟网络中创建应用程序网关。Create an application gateway in the virtual network, following the steps in the application gateway quickstart. 以下 az network application-gateway create 命令创建一个网关,该网关使用某个公共前端 IP 地址以及用于连接后端容器组的路由。The following az network application-gateway create command creates a gateway with a public frontend IP address and a route to the backend container group. 有关网关设置的详细信息,请参阅应用程序网关文档See the Application Gateway documentation for details about the gateway settings.

az network application-gateway create \
  --name myAppGateway \
  --location chinaeast2 \
  --resource-group myResourceGroup \
  --capacity 2 \
  --sku Standard_v2 \
  --http-settings-protocol http \
  --public-ip-address myAGPublicIPAddress \
  --vnet-name myVNet \
  --subnet myAGSubnet \
  --servers "$ACI_IP" 

Azure 最长可能需要花费 15 分钟时间来创建应用程序网关。It can take up to 15 minutes for Azure to create the application gateway.

测试公共 IP 地址Test public IP address

现在,可以测试性地访问在应用程序网关后面的容器组中运行的 Web 应用。Now you can test access to the web app running in the container group behind the application gateway.

运行 az network public-ip show 命令以检索网关的前端公共 IP 地址:Run the az network public-ip show command to retrieve the frontend public IP address of the gateway:

az network public-ip show \
--resource-group myresourcegroup \
--name myAGPublicIPAddress \
--query [ipAddress] \
--output tsv

输出是一个公共 IP 地址,类似于 52.142.18.133Output is a public IP address, similar to: 52.142.18.133.

若要在成功配置后查看正在运行的 Web 应用,请在浏览器中导航到该网关的公共 IP 地址。To view the running web app when successfully configured, navigate to the gateway's public IP address in your browser. 成功访问后,会显示如下所示的界面:Successful access is similar to:

浏览器屏幕截图,显示应用程序在 Azure 容器实例中运行

后续步骤Next steps

  • 参阅快速入门模板,了解如何在应用程序网关后面创建一个使用 WordPress 容器实例作为后端服务器的容器组。See a quickstart template to create a container group with a WordPress container instance as a backend server behind an application gateway.
  • 还可以使用用于 SSL 终止的证书来配置应用程序网关。You can also configure an application gateway with a certificate for SSL termination. 请参阅概述教程See the overview and the tutorial.
  • 根据你的方案,请考虑将其他 Azure 负载均衡解决方案与 Azure 容器实例配合使用。Depending on your scenario, consider using other Azure load-balancing solutions with Azure Container Instances. 例如,使用 Azure 流量管理器在多个容器实例和多个区域之间分配流量。For example, use Azure Traffic Manager to distribute traffic across multiple container instances and across multiple regions. 请参阅此 博客文章See this blog post.