Ingress "Limited to VNet" Option Missing in Azure Container Apps?

Question

I’m configuring ingress for Azure Container Apps and noticed that only the following two ingress options are available:

Accepting traffic from anywhere

Limiting traffic to the Container Apps Environment

I no longer see the “Limited to VNet” option.

However, I’ve found older posts and documentation (for example: https://github.com/microsoft/azure-container-apps/discussions/1033) that mention an ingress option limited to a VNet. Has this option been deprecated or replaced? If so, what is the current recommended approach to restrict ingress to a specific VNet?

Any clarification would be appreciated.

Answer 1

Hello @CY Lee

As of now, Azure Container Apps provides two options for ingress:

1. Accepting traffic from anywhere (external ingress)
2. Limiting traffic to the Container Apps Environment (internal ingress).

The "Limited to VNet" option that you’ve referenced might have been part of older configurations or discussions. In recent changes, Azure has streamlined ingress options for ease of use, and it appears the direct granularity of limiting access specifically to a VNet is not explicitly provided in the newer implementation.

For environments that require this level of control, you can effectively achieve a similar outcome by configuring your ingress settings and leveraging Azure's VNet integration:

• Deploy your Container Apps environment to a VNet: This will ensure that your application can only be accessed from within the designated network.
• Utilize network security groups (NSGs) to enforce policies that restrict traffic based on your needs.

In case you are looking to further enhance your ingress control:

• Consider using additional Azure services like Azure Application Gateway or Azure Front Door for advanced routing setups.
• You can configure IP restrictions to further refine who can access your application.

Please find the documentation below:

https://learn.microsoft.com/en-us/azure/container-apps/ingress-overview

https://learn.microsoft.com/en-us/azure/container-apps/ingress-how-to?pivots=azure-cli

Answer 2

The "Limited to VNet" option for ingress in Azure Container Apps is not currently available as you noted. The available options are indeed limited to:

1. Accepting traffic from anywhere
2. Limiting traffic to the Container Apps Environment

It appears that the option to limit ingress to a specific Virtual Network (VNet) may have been deprecated or is not available in the current configuration settings. For restricting ingress to a specific VNet, the recommended approach would be to utilize the existing options and ensure that your application is deployed within a VNet that meets your security requirements.

For the latest updates or changes regarding ingress options, it is advisable to refer to the official Azure documentation or announcements from Microsoft regarding Azure Container Apps.

---

References:

• Configure ingress for your app in Azure Container Apps (azure-portal)
• Configure ingress for your app in Azure Container Apps (azure-cli)
• Troubleshoot a container app