This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(105.60000000000001, 88%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAP%3C/text%3E%3C/svg%3E)
We have some APIs running in microservices inside AKS which is attached to a private network with inbound and outbound rules. We have spark jobs running in Synapse studio which have to call the APIs running AKS. How to configure the network or how to allow the traffic from Synapse spark pool.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 51%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPD%3C/text%3E%3C/svg%3E)
I have a similar requirement - I have APIs running in AKS which is available via a private load balancer. In my scenario, there are no network rules. I can ping my service using a Synapse Linked Service, but I am unable to connect to the API is a Synapse notebook running in an Apache Spark Pool. The vnet hosting Synapse is peered to the vnet hosting AKS. None of the links listed below have worked for me. Is there any other info you can provide to make this connection work?
how did you peer the vnet hosting synapse
good question. turns out I was misinformed. The vnets are not peered. At least now I know WHY I can't connect to the API's private IP. I'd still like to know HOW to do it.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 4%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EKM%3C/text%3E%3C/svg%3E)
Hello, @Akhilesh Pachipulusu !
If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!
Hello @Akhilesh Pachipulusu
Thank you for posting this concern on this community space.
I was reading your case scenario description and I was reading the following article that I thought it might be work for your environment.
https://blog.cellenza.com/en/data/using-spark-with-kubernetes-k8s/
I hope that can be useful for you.
Looking forward to your feedback,
Cheers,
Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
We need to use to the spark pool available in Azure Synapse, so need connectivity between synapse spark pool and our vnet
by using managed VNet, azure manages the vnet, we do not get any details of it to peer with our network
https://learn.microsoft.com/en-us/azure/synapse-analytics/security/how-to-connect-to-workspace-from-restricted-network we want reverse of it, connect to restricted network from workspace resources
Did you configure this "connect to restricted network from workspace resources" when you were creating?
we want to know how to configure that, there is not option for it while creating
we want to configure that, there is no option while creating
with this option we can add firewall rules on synapse, we have allowed all traffic inbound and outbound in synapse. But we have firewall rule in our aks VNet which has inbound traffic firewall rule. Now how do I add inbound rule to allow the traffic from synapse spark pool, I need IP ranges that I can allow them
You have to select on the resource type drop-down menu the following option below when creating the endpoint: 
that creates an endpoint to access the kubernetes endpoint, but we want to allow inbound traffic into the load balancer inside AKS
Understood.
So please review this link below:
https://learn.microsoft.com/en-us/azure/aks/internal-lb
or
https://learn.microsoft.com/en-us/azure/aks/api-server-vnet-integration
That's what I am getting after your kindly explanation during this entire post.
Let me know if that works for you.
Hello @Akhilesh Pachipulusu
Please let me know if that was useful or not so, We can keep assist you.
Have a good one!
We already have a AKS cluster and a load balancer using which the API can be accessed, but the subnet has firewall rule which filters inbound traffic, we either need to allow the traffic in security group or peer the network, for that we need the network details of synapse spark pool. Like the VNet details or the IP range
Ok let me prepare a better response on this.
Shortly I will be getting back to you with the proper response.
Many thanks!
Please check the link above...
Besides that, I was trying to find a workaround or possible way to get it to the right track might be to:
Create a private link hubs resource. After, you will have to create a private endpoint from your Azure virtual network to this private link hub.
Looking forward to hearing from you
Cheers!
Hello @Akhilesh Pachipulusu
I hope you are doing great.
I am pending for your response in order to know if further help is required.
Looking forward to hearing from you
Cheers!
@Akhilesh Pachipulusu What service are you using within Synapse to call your API? I am using a Notebook with c# code. I choose this service because I am trying to consume a gRPC endpoint and did not see any other methods for doing so. This is not working for me. But I did have luck using a Linked Service with a self-hosted integrated runtime (SHIR). The SHIR is in a vnet that is peered to the vnet where my AKS cluster is running. If you are trying to consume a REST API, I suggest you try using a Linked Service.
The solution is to create a private link service using the load balancer of the AKS and create a managed private endpoint in the synapse workspace. Use the URL defined in the manage endpoint to access the APIs
when creating the private endpoint in Synapse, what domain name did you provide for the FQDN?