Samun app ɗin Container Apps na sirri ta VPN na aya-zuwa-wuri

Wannan littafin yana bayani kan yanayin Container Apps mai furofayil ɗin nauyin aiki da shigar cibiyar sadarwa ta ciki, wanda ake isa gare shi daga kwamfutar tafi-da-gidanka ta VPN na aya-zuwa-wuri da aka amince da shi, ta amfani da FQDN kai tsaye na app ɗin kuma ba tare da hanyoyin HTTP a matakin yanayi ba. ana iya isa shigar yanayin daga abokin ciniki, iyakar shigar app ɗin tana karɓar mai kira, kuma ana warware sunan host zuwa shigar sirri. Kowane mataki da ke ƙasa yana barin sakamako mai iya tabbatarwa da juyawa baya wanda ba ya taɓa wani abu da ba ka canza ba. Bi su cikin tsarin da aka bayar, domin babu wani mataki na gaba da zai iya rama shawarar iyaka da aka yanke kuskure a mataki na 1.

Kafin ka taɓa DNS, fayyace kalmar ciki. Ana amfani da ita ga iyakoki biyu daban-daban a cikin wannan samfur, kuma musanya su shine mafi yawan dalilin da suna mai aiki har yanzu ba ya mayar da wani abu mai amfani.

Mataki 1: tabbatar da iyakar yanayi da app

Karanta tsarin shigar app ɗin kafin ka canza kowane rikodi:

Ana fallasa shigar ciki akan ma'aunin nauyi na ciki na yanayin a cikin VNet ɗin yanayin, don haka tambayar ba ita ce ko kwamfutar tafi-da-gidanka wata app ɗin kwantena ba ce, amma ko za ta iya isa wannan VNet ɗin. Abokin ciniki na VPN mai hanyar shiga VNet ɗin kuma ana warware yankin da aka saba na yanayin ta yankin sirri shine mai kira da ya cancanta, kuma abin da sauran matakan ke ginawa ke nan. Yanayin ciki ba tare da shiga na jama'a ba wata hujja ce daban da app mai shigar ciki, kuma shigar waje a matakin app ba ya ba yanayin ƙofar jama'a. Rubuta iyakar a cikin tikitin da kuma a portal ɗin, domin injiniyan na gaba yana karanta tikitin farko.

Tabbatar da wannan iyakar tare da mai tsarin kafin ka ci gaba, kuma ka riƙe ƙofar a ƙunci: idan babu hanyar shiga VNet ɗin yanayin, ko kuma ba a warware yankin da aka saba na yanayin ta yankin sirri ba, tsaya ka gyara wannan hanyar da farko. Babu wani mataki na gaba da zai maye gurbin mai kira wanda ba zai iya isa VNet ɗin ko warware sunan ba.

Mataki 2: tattara ainihin sunan host da adireshin shiga

Yi rikodin yankin da aka saba na yanayin, adireshin shigarsa na sirri na tsaye da FQDN ɗin app ɗin da aka saita, waɗanda aka ɗauka daga albarkar ba daga tsohon hoton allo ko shafin wiki ba:

az containerapp env show -n ENV -g RG \
  --query "{domain:properties.defaultDomain, ip:properties.staticIp}"
az containerapp show -n APP -g RG \
  --query "properties.configuration.ingress.fqdn"

Jagorar shigar sirri na Container Apps tana bayanin daidaita yankin yanayin da adireshinsa na ciki yayin da ake kiyaye sunayen host na aikace-aikacen cikakke. Wannan shine ainihin siffar da kake ginawa da hannu a nan, don haka daidaita abubuwan yankin da ita maimakon ƙirƙirar sabon tsarin suna.

Idan yankin da ka karanta bai dace da FQDN ɗin da app ɗin ke bayarwa ba, tsaya ka daidaita su yanzu. Gina yankin akan ƙarshen da ba daidai ba yana haifar da sunan host da ke warwarewa daidai kuma har yanzu yana sauka akan host ɗin kama-da-wane mara daidai.

Mataki 3: sanya yankin sirri akan hanyar mai warwarewa ta VPN

Ƙirƙiri ko sake amfani da yankin DNS na sirri da ake tallafawa don ainihin yankin da aka saba na yanayin, tare da rubutattun rikodin wildcard da adireshi da ke nuni ga shigar tsaye. Haɗa wannan yankin da cibiyar sadarwar kama-da-wane da ta dace, kuma sanya ikon sirri ya isa ta hanyar mai warwarewa da aka amince da ita ta VPN maimakon ɗauka cewa haɗin ya isa.

Abokin ciniki na aya-zuwa-wuri yawanci yana buƙatar ƙarshen shiga na mai warwarewa na sirri ko mai tura DNS da ake tallafawa don isa wannan yankin. Haɗa yanki yana canza abin da Azure ke warwarewa ga cibiyoyin sadarwar da aka haɗa; ba ya sake turawa mai warwarewa na jama'a na kowace kwamfutar tafi-da-gidanka ta waje. Kada ka maye gurbinsa da yankin DNS na ƙarshen sirri da aka aro daga wani tsarin sadarwa na Container Apps, domin sunayen rikodi da ƙarshen yankin ba za su dace ba.

Juyawa baya ga wannan mataki shine cire haɗin yankin ko rikodin da ka ƙara. Yi rikodin wanne ne daga cikinsu, domin share yanki da aka raba don soke haɗi ɗaya sanannen hanya ce ta karya wani yanayi na biyu.

Mataki 4: gwada sunan, sannan masu sauraron da aka ƙi

Gwada sunan host da ainihi na TLS tare, ba adireshi kaɗai ba. Don binciken taswira na suna mai sarrafawa zaka iya ƙulla adireshin yayin kiyaye sunan host:

curl --resolve app.ENVIRONMENT_DOMAIN:443:10.40.0.10 \
    https://app.ENVIRONMENT_DOMAIN/

Maye gurbin sunan host da ainihin FQDN ɗin app ɗin kuma adireshin da ainihin shigar ciki. Wannan yana shafar wannan buƙata ɗaya kawai kuma ba samar da DNS ba ne. Kada ka ƙara -k don mai da gazawar ainihi zuwa nasara ta bayyane, domin rashin daidaiton takardar shaida shine alamar cewa kana buga mai sauraro mara daidai.

Neman adireshin lamba kai tsaye na iya zaɓar host ɗin kama-da-wane mara daidai ko gazawar tabbatarwa ko da TCP 443 yana amsawa, don haka ɗauki gwajin IP mai nasara a matsayin hujja kan cibiyar sadarwa kuma ba wani abu ba. Daga kwamfutar tafi-da-gidanka da aka nufa, hanyar mai warwarewa ta al'ada ita ce mai tura DNS na abokin ciniki ko ƙarshen shiga na mai warwarewa na sirri wanda ke ɗaukar yankin, kuma gazawa a can matsala ce ta isa ga mai warwarewa ba rikodin da ya ɓace ba. Tabbatar cewa wannan buƙatar ɗaya ta yi nasara akan wannan hanyar, sannan tabbatar cewa masu sauraron da aka ƙi har yanzu ana ƙi su.

Abin da za a rikoda, da abin da za a juya baya

Tashar manufa ta kwantena da tashar HTTPS ta abokin ciniki saiti ne daban. Kada ka wallafa tashar manufa ta kwantena ta VPN saboda kwantena yana saurare a can, kuma kada ka faɗaɗa ƙa'idar cibiyar sadarwa don gwajin tasha ya wuce. Duk sauye-sauyen biyu suna wucewa bayan lamarin kuma suna da wahalar dangantawa daga baya.

Kammala da sabon aikin aikace-aikace daga kwamfutar tafi-da-gidanka da aka nufa, ta amfani da ainihin da aka ba da izini da DNS ɗinsa na al'ada, sannan duba cewa mai kira mara izini har yanzu yana gazawa. Yayin da kake cikin tsarin app ɗin, kuma tabbatar ko hanyar HTTP a matakin yanayi tana fallasa wannan app ɗin a matsayin manufa, domin wannan hanyar ita ce ƙofa ta biyu da iyakar shiga ba ta bayyana ba.

Yi rikodin dabiƙu biyar tare: iyakar yanayi, iyakar shigar app ɗin, FQDN, adireshin shigar sirri da mai yankin mai warwarewa. Waɗannan biyar suna bayyana dukan yarjejeniyar shiga, kuma mutumin da zai gyara ta na gaba zai nemi su daidai.