-
Notifications
You must be signed in to change notification settings - Fork 189
fix : WAF deployment: private backend ingress and frontend proxy rou… #561
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: dev
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -931,7 +931,8 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = { | |||||
| } | ||||||
| ] | ||||||
| enableTelemetry: enableTelemetry | ||||||
| publicNetworkAccess: 'Enabled' // Always enabled for Container Apps Environment | ||||||
| publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' | ||||||
| internal: enablePrivateNetworking ? true : false | ||||||
|
|
||||||
| // <========== WAF related parameters | ||||||
|
|
||||||
|
|
@@ -944,6 +945,34 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = { | |||||
| } | ||||||
| } | ||||||
|
|
||||||
| // ========== Private DNS Zone for internal Container App Environment ========== // | ||||||
| // When the CAE is internal, its FQDN is resolvable only within the VNet via this zone. | ||||||
| module caeDnsZone 'br/public:avm/res/network/private-dns-zone:0.8.0' = if (enablePrivateNetworking) { | ||||||
| name: take('avm.res.network.private-dns-zone.cae.${solutionSuffix}', 64) | ||||||
| params: { | ||||||
| name: avmContainerAppEnv.outputs.defaultDomain | ||||||
| tags: tags | ||||||
| enableTelemetry: enableTelemetry | ||||||
| a: [ | ||||||
| { | ||||||
| name: '*' | ||||||
| aRecords: [ | ||||||
| { | ||||||
| ipv4Address: avmContainerAppEnv.outputs.staticIp | ||||||
| } | ||||||
| ] | ||||||
| ttl: 300 | ||||||
| } | ||||||
| ] | ||||||
| virtualNetworkLinks: [ | ||||||
| { | ||||||
| name: take('vnetlink-vnet-${solutionSuffix}-cae', 64) | ||||||
| virtualNetworkResourceId: virtualNetwork!.outputs.resourceId | ||||||
| } | ||||||
| ] | ||||||
| } | ||||||
| } | ||||||
|
|
||||||
| // //=========== Managed Identity for Container Registry ========== // | ||||||
| module avmContainerRegistryReader 'br/public:avm/res/managed-identity/user-assigned-identity:0.5.0' = { | ||||||
| name: take('avm.res.managed-identity.user-assigned-identity.${solutionSuffix}', 64) | ||||||
|
|
@@ -1132,7 +1161,7 @@ module avmContainerApp_API 'br/public:avm/res/app/container-app:0.22.1' = { | |||||
| } | ||||||
| ] | ||||||
| } | ||||||
| ingressExternal: true | ||||||
| ingressExternal: enablePrivateNetworking ? false : true | ||||||
|
||||||
| ingressExternal: enablePrivateNetworking ? false : true | |
| ingressExternal: true |
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
|
@@ -934,7 +934,8 @@ module avmContainerAppEnv 'br/public:avm/res/app/managed-environment:0.13.2' = { | |||||||||
| } | ||||||||||
| ] | ||||||||||
| enableTelemetry: enableTelemetry | ||||||||||
| publicNetworkAccess: 'Enabled' // Always enabled for Container Apps Environment | ||||||||||
| publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' | ||||||||||
| internal: enablePrivateNetworking ? true : false | ||||||||||
|
Comment on lines
+937
to
+938
|
||||||||||
| publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' | |
| internal: enablePrivateNetworking ? true : false | |
| publicNetworkAccess: 'Enabled' | |
| internal: false |
Copilot
AI
Apr 22, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
With ingressExternal set to false in private networking mode, the API Container App FQDN will no longer be reachable from outside the VNet. The repo's post-deployment scripts currently use CONTAINER_API_APP_FQDN to wait for readiness and register schemas from the deployer's machine; that flow will fail for enablePrivateNetworking=true. Consider updating the post-deployment workflow to call the API through the web app's new /api proxy (using CONTAINER_WEB_APP_FQDN) or to execute the registration from within the VNet (e.g., via the jumpbox).
| ingressExternal: enablePrivateNetworking ? false : true | |
| ingressExternal: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -18,6 +18,18 @@ http { | |
| listen 3000; | ||
| server_name localhost; | ||
|
|
||
| # Route browser API calls through the web container so private backend | ||
| # endpoints remain internal-only in WAF/private networking deployments. | ||
| location /api/ { | ||
| proxy_http_version 1.1; | ||
| proxy_set_header Host $host; | ||
| proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; | ||
| proxy_set_header X-Forwarded-Proto $scheme; | ||
| proxy_set_header Upgrade $http_upgrade; | ||
| proxy_set_header Connection "upgrade"; | ||
| proxy_pass APP_BACKEND_API_URL/; | ||
| } | ||
|
Comment on lines
+21
to
+31
|
||
|
|
||
| location / { | ||
| root /usr/share/nginx/html; | ||
| try_files $uri $uri/ /index.html; | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Setting the Container Apps Environment to
internal: trueandpublicNetworkAccess: 'Disabled'means the environment (and therefore the web Container App inside it) will be reachable only within the VNet. This conflicts with the template still configuring the web Container App ingress as external (ingressExternal: truelater in this file). Either keep the environment external and make only the API app's ingress internal, or also make the web app ingress/internal routing consistent with an internal environment (and document the required WAF/App Gateway in front).