Does Azure Container Apps support VNET integration or VNET peering?

Question

Does Azure Container Apps support VNET integration or VNET peering?

Pitawat 351

I am testing the new Azure Container Apps. I see this documentation that each app in the same environment is deployed in the same virtual network but I don't see any networking configurations on Azure Portal.

Normally I deploy my apps on App Service with VNET integration which uses my own private IP address space and peer App Service VNET with Azure SQL Managed Instance VNET so my apps can access the database. Is this possible with Azure Container Apps? If no, how can apps access the database that does not allow public endpoints?

Thanks.

Pitawat 351 Reputation points

2021-11-09T04:45:05.067+00:00

Seems like Microsoft Q&A forum does not have a tag for Azure Container Apps yet. That's why I tag only Azure Virtual Network. Please inform me if there is a more appropriate tag for this topic. Thanks.
GitaraniSharma-MSFT 50,287 Reputation points Microsoft Employee Moderator

2021-12-09T08:45:11.587+00:00

Hello @Pitawat

I discussed this query with the Azure Container Apps Product group team and below is their response:

The documentation is a bit misleading. VNET Injection for Container Apps is on our roadmap and being actively worked on. The private IP access scenario that you have explained with the database is not possible with Azure Container Apps at present. It has to be public endpoint today.

Regards,
Gita

Answer accepted by question author

Andriy Bilous 12,596 MVP

****Update 2nd of February 2022****
Azure Container Apps now supports Virtual Network Integration

To host your containerized applications using Azure Container Apps, you must first deploy an Azure Container Apps environment. The environment can host one or more applications and establishes the network boundary, meaning all applications within the shared environment are deployed to the same Azure virtual network.
https://techcommunity.microsoft.com/t5/apps-on-azure-blog/azure-container-apps-virtual-network-integration/ba-p/3096932

Hello @Pitawat

Azure Container Apps has been announced on the 2nd of November 2021 and currently in Preview state.
Azure Container Apps does not currently support VNET integration or PrivateEndpoint.

The use cases of Azure Container Apps:

Deploying API endpoints
Hosting background processing applications
Handling event-driven processing
Running microservices

You may allow communications from all resources inside the Azure boundary to SQL via the firewall pane

https://learn.microsoft.com/en-us/azure/azure-sql/database/network-access-controls-overview#allow-azure-services

https://techcommunity.microsoft.com/t5/apps-on-azure/introducing-azure-container-apps-a-serverless-container-service/ba-p/2867265

0 comments

2 additional answers

Your answer

Pitawat 351 Reputation points

2021-11-09T04:45:05.067+00:00

Seems like Microsoft Q&A forum does not have a tag for Azure Container Apps yet. That's why I tag only Azure Virtual Network. Please inform me if there is a more appropriate tag for this topic. Thanks.
GitaraniSharma-MSFT 50,287 Reputation points Microsoft Employee Moderator

2021-12-09T08:45:11.587+00:00

Hello @Pitawat

I discussed this query with the Azure Container Apps Product group team and below is their response:

The documentation is a bit misleading. VNET Injection for Container Apps is on our roadmap and being actively worked on. The private IP access scenario that you have explained with the database is not possible with Azure Container Apps at present. It has to be public endpoint today.

Regards,
Gita

Answer 1

Daniel Krzyczkowski 501 MVP

It is now possible to integrate Azure Container Apps with VNET, here is the announcement:
https://techcommunity.microsoft.com/t5/apps-on-azure-blog/azure-container-apps-virtual-network-integration/ba-p/3096932

0 comments

Answer 2

Bohdan Chornii 1

Are there plans to support integration with on-prem resources via VPN or Azure Express Route ?

GitaraniSharma-MSFT 50,287 Reputation points Microsoft Employee Moderator

2021-12-09T08:50:56.553+00:00

Hello @Bohdan Chornii ,

As per the product group team, integration with on-prem resources is not on our immediate roadmap for Azure Container Apps. We always appreciate insight into requirements to help with future planning iterations.

If you wish you may leave your feedback in the below uservoice forum requesting this feature. All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.
https://feedback.azure.com/d365community/search/?q=azure+container

Regards,
Gita
Pitawat 351 Reputation points

2021-12-09T09:22:15.62+00:00

Hello @GitaraniSharma-MSFT ,

I am a bit confused here. You have just commented below my question that VNET for container apps is on the roadmap and is being worked on. But you commented here that it is not on the roadmap.

Which one is true? Thanks.
Pitawat 351 Reputation points

2021-12-09T09:27:20.71+00:00

Also, I would like to post an idea for this topic on Feedback forum but there is no forum for Container Apps. Could you add it or which forum should I post it to? Thanks.
GitaraniSharma-MSFT 50,287 Reputation points Microsoft Employee Moderator

2021-12-09T10:03:58.28+00:00

Hello @Pitawat ,

Both statements are true.
As I mentioned in the comment below your question, VNET Injection for Container Apps is on our roadmap and being actively worked on. However, that might not provide integration with on-prem resources.
Just like when the Vnet integration feature on WebApps/App service went GA. It initially only provided the Gateway-required virtual network integration which doesn't work with ExpressRoute. Later Regional virtual network integration was introduced which removed that limitation.
Refer : https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

Regards,
Gita
GitaraniSharma-MSFT 50,287 Reputation points Microsoft Employee Moderator

2021-12-09T10:07:37.127+00:00

@Pitawat , since Azure container apps is in preview, a specific forum for it has not been created yet. Once it goes GA, the forum page will be added.
In the meantime, you can provide your feedback under "General Feedback" forum like the one posted below:
https://feedback.azure.com/d365community/idea/b9bd6cdf-9344-ec11-a819-0022484bf651