How to call Azure Private Zone custom URLs points to AKS from App Service?

JaiHoDevs 0

We have created an AKS Cluster and deployed two services using ingress controller as load balancer. Also created a private DNS Zone with A records for these two services. The host with prefix properly given Ingress.YAML file and configured. Able to curl call to private links from AKS run command window.

Ex: http://api1.<private DNS Zone name>

http://ap2.<private DNS Zone name>

Now we have an UI application hosted on Azure app service (Allow public access is checked), now from that UI unable to call these links. Getting GET <url> net::ERR_NAME_NOT_Resolved

A virtual network created with two Subnets, one for AKS cluster and another for App service.. App service also enabled VNet Integration.

For more trouble to avoid client environment, we have done same kind of setup using another subscription.. Same issue from browser but curl -v <url> getting output in middle with Http/1.1 200 OK with connection #0 to host <url> left intact (in red lines).. Also host:port able to call from Azure app service Network troubleshoot page..

Both envs, from cluster able to curl all to private DNS links. But client env, links not able to call in Kudo, our env able to get Http/1.1 200 OK with connection #0 to host <url> left intact (in red lines).

Client Environment troubleshoot from Kudu app service(scm link):

tcpping ap1.<private dns zone name>

Connection attempt failed: Connection timed out.

tcpping <dns zone name>

Connection attempt failed: No such host is known.

nameresolver <private dns zone name>

Server: 168.63.129.16

Non-authoritative answer:

Name: <private dns zone name>

nameresolver api1.<private dns zone name>

Server: 168.63.129.16

Non-authoritative answer:

Name: <private dns zone name>

Addresses: 10.xxx.x.x (ingress controller load balancer)

Expecting that these private dns zone links should call from UI app via browser window.

Please suggest. Appreciate your Quick help here. Thank you.

Isaac Vergara 0 Reputation points

2023-09-28T15:34:54.13+00:00

Good evening,

I assume you tested connectivity directly with the Ingress Controler from the app service, is that correct?

Also, did you check that traffic flow between both subnets is allowed, and the subnet of the app service is linked to the private zone? Otherwise it could not resolve the private zone.

Kind regards,
ajkuma 26,136 Reputation points Microsoft Employee

2023-09-29T09:14:20.7166667+00:00

JaiHoDevs's inline reply to Isaac Vergara:

1. Tested connectivity with private dns zone record links pointed to IP address of the ingress controller load balancer. Working from Cluster but not from app service. I created a new envrionment similar like client env. Mentioned both envs connectivity with output details. Please suggest.

2. Both subnets are in a VNET, that VNET links is added to Private DNS zone under "Virtual networks links"

(@JaiHoDevs, looks like your recent comment was missing (at this time), I have just copied here - Apologies for this issue, I have relayed the feedback to our Q&A platform team)
ajkuma 26,136 Reputation points Microsoft Employee

2023-10-02T08:06:27.6333333+00:00

@JaiHoDevs , Just checking in to see if you had got a chance to see the previous response. If the answer helped (pointed, you in the right direction) > please click Accept Answer Or please share the requested/more info to help you better.
SnehaAgrawal-MSFT 21,506 Reputation points

2023-10-03T09:58:48.8266667+00:00

@JaiHoDevs

We noticed your recent experience on the Q&A community platform was rated low (Answer provided was not helpful).

Thank you for taking time to share your feedback.

Kindly let us know what we could have done better to make your experience a positive one.

We are here to help you and strive to make your experience better and greatly value your feedback.

If you have any questions, please let us know we will be more than happy to assist you further.

We would appreciate if you may consider e-surveying for the engagement you received on the thread by ajkuma.

Your feedback is very important to us.

Looking forward to your reply.

Thanks again for your time and feedback.

1 answer

ajkuma 26,136 Reputation points Microsoft Employee

2023-09-29T09:24:45.3233333+00:00

@JaiHoDevs , Following-up on this, I understand you have already tried several things to isolate the issue.

Just to highlight, please sure that from your App Service you can reach the DNS Server (defined in VNET). You may test this with "tcpping <IP_DNS_Server>:53".

Also, ensure that the App Service do not have other DNS defined in addition to the one in the VNET. To review this, you will need to check the property: properties.dnsConfiguration.dnsServers - as outlined in this doc Name resolution (DNS) in App Service - You may check this in JSON view of the resource or in Resource Explorer.

Kindly confirm that you do not have an appsetting of type WEBSITE_DNS_SERVER (App Service > Configuration > AppSettings).

Kindly let us know how it goes, I'll follow-up with you further.
Please sign in to rate this answer.
JaiHoDevs 0 Reputation points

2023-10-03T11:33:05.9266667+00:00

@ajkuma

I am using azure private DNS Zone, hence I have an appsetting of type WEBSITE_DNS_SERVER to 168.63.129.16

Also tried with tcpping 168.63.129.16:53 and getting connected to 168.63.129.16:53, time taken: < 1ms.

Also another app setting I have is WEBSITE_VNET_ROUTE_ALL to 1.

I found this on Resource explorer: "dnsConfiguration": {}

Please suggest. Thanks

ajkuma 26,136 Reputation points Microsoft Employee

2023-10-03T15:18:54.5166667+00:00

Thanks for the follow-up and update. Your Azure App Service uses this local Azure DNS. You mentioned that when your AKS applications were created, you had to create a Private DNS Zone (and after that, you can resolve FQDNs within the AKS). Most likely, you are missing a Virtual Network Link between the Private DNS Zone and the VNET where your App Service is hosted, please review and let us know. I'll follow-up further.

Just to highlight:

Virtual Network Links are configured at the Private DNS Zone resource. Each VNET has it's own Azure DNS Server, so when you link a Private DNS Zone to a VNET, you are telling Azure DNS how has to resolve endpoints defined in the Private DNS Zone.
Ref: Name resolution for resources in Azure virtual networks and Name resolution (DNS) in App Service

JaiHoDevs 0 Reputation points

2023-10-03T15:28:32.7066667+00:00

I have VNet link to azure private dns zone.

JaiHoDevs 0 Reputation points

2023-10-03T15:32:23.6333333+00:00

from APP service Kudu

curl -v https://ap1.<private dns zone>

trying to connect 10.XXX.x.X:443

curl: (28) failed to connect to api1.<private dns zone> port 443 after 21371 ms: could not connect to server

any idea?

JaiHoDevs 0 Reputation points

2023-10-03T16:03:55.55+00:00

WEBSITE_DNS_SERVER is private DNS zone A record of the IP Address ??

ajkuma 26,136 Reputation points Microsoft Employee

2023-10-04T10:30:05.6533333+00:00

Thanks for the follow-up. If it's fine, could you please share your (public) WebApp name here for additional investigation?

Note: Please do not share any PII data on the public forum.

JaiHoDevs 0 Reputation points

2023-10-16T15:00:52.96+00:00

@ajkuma: Quick question: Can app service with public acess (UI application hosted) calls API inside private aks Cluster using Private DNS zone? Is this possible? If yes, any steps for that?

ajkuma 26,136 Reputation points Microsoft Employee

2023-10-16T19:40:06.0433333+00:00

It looks like, it's been answered by one of colleague on your another thread. Thanks!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to call Azure Private Zone custom URLs points to AKS from App Service?

1 answer

Your answer