How to connect to a azure cosmos DB with a private endpoint from a public azure Kubernetes service

Question

How to connect to a azure cosmos DB with a private endpoint from a public azure Kubernetes service.

I have a Go application deployed in azure aks (not private) which needs access a private cosmos database. Is there a way to whitelist aks or allow traffic from aks to the database.

Answer 1

Hi,
You can connect by creating a VNET peering between the AKS VNET and the Cosmos DB private endpoint VNET, or by creating a cosmos DB private endpoint using the AKS VNET.

Answer 2

We have a reference implementation for building and deploying containerized applications for Azure Kubernetes Service and Azure Cosmos DB. This reference implementation has two flavors, all Bicep and Bicep + Azure Service Operator for Azure Cosmos DB allowing operators to manage Cosmos DB via kubectl.

The other parts include using KeyVault integrated into secret store, managed service identity (auth/n) with RBAC (auth/z), log analytics for monitoring and also has VNET integration using Service Endpoints (not private endpoints).

While this doesn't give you exactly everything with private endpoints, it's very close. Just need to configure the private endpoints for Cosmos DB and private DNS for AKS to connect.

Can start with our blog post on this which walks you through the implementation with links to a GitHub repository you can git clone, modify and deploy yourself.