Gaadhista app-ka Container Apps ee gaar ah iyada oo loo marayo VPN dhibic-ilaa-goob
Deegaan gudaha Container Apps ah wuxuu u baahan yahay laga-gelid gaar ah, magac martigeliye oo u dhigma iyo xallin-qaade uu VPN-ku gaari karo. Dhammee tallaabo kasta, ka dibna xaqiiji diidmada.
Buuggani wuxuu daboolayaa deegaan Container Apps oo leh borofayl culeys shaqo iyo laga-gelid shabakad-farshaxan gudaha ah, oo laga gaaro kombuyuutar la qaato iyada oo loo marayo VPN dhibic-ilaa-goob la ansixiyay, iyada oo la isticmaalayo FQDN tooska ah ee app-ka oo aan lahayn waddooyin HTTP heer deegaan ah. laga-gelidda deegaanku waa laga gaari karaa macmiilka, baaxadda gelitaanka app-ku waxay ogolaataa wacaha, magaca martigeliyahana waxaa loo xalliyaa laga-gelidda gaarka ah. Tallaabo kasta oo hoose waxay ka tagtaa natiijo la xaqiijin karo iyo dib-u-noqod aan taaban wax aanad beddelin. Ku dhammee sida ay u kala horreeyaan, maxaa yeelay ma jiro tallaabo dambe oo magdhow u noqon karta go'aanka baaxadda oo si khaldan loo qaatay tallaabada 1.
Ka hor inta aadan taaban DNS, caddee ereyga gudaha. Badeecaddan waxaa loo adeegsadaa laba baaxadood oo kala duwan, is-beddelkooduna waa sababta ugu caansan ee magac shaqeeya uu wali wax faa'iido leh soo celin waayo.
Tallaabada 1: go'aami baaxadda deegaanka iyo app-ka
Akhri qaabeynta gelitaanka app-ka ka hor inta aadan beddelin diiwaan kasta:
| Setting | Boundary |
|---|---|
| Internal environment | The environment entry is reached through its private network arrangement |
| App with internal ingress | Callers from the environment VNet only; a VPN laptop qualifies once it has a route into that VNet and the domain resolves privately |
| App with external ingress in an internal environment | The app accepts outside traffic through the environment's private entry |
Gelitaanka gudaha waxaa lagu soo bandhigaa isku-dheellitirka culeyska gudaha ee deegaanka gudaha VNet-ka deegaanka, sidaas darteed su'aashu maahan in kombuyuutarka la qaato uu yahay app kale oo weel, laakiin in uu gaari karo VNet-kaas. Macmiil VPN oo leh waddo gudaha VNet-ka iyo domain-ka caadiga ah ee deegaanka oo lagu xalliyo aagga gaarka ah waa wace ka qalma, taasna waa waxa tallaabooyinka hadhay dhisaan. Deegaan gudaha ah oo aan lahayn laga-gelid dadweyne waa xaqiiqo ka duwan app leh gelitaan gudaha, gelitaanka dibadda heer app-na ma siiyo deegaanka albaab dadweyne. Baaxadda ku qor tigidhka iyo sidoo kale bogga, maxaa yeelay injineerka xiga wuxuu marka hore akhriyaa tigidhka.
La xaqiiji baaxaddaas milkiilaha qaabeynta ka hor inta aadan sii wadin, oo albaabka ku hay cidhiidhi: haddii aan jirin waddo gudaha VNet-ka deegaanka, ama domain-ka caadiga ah ee deegaanku aan lagu xallin aagga gaarka ah, joogsada oo marka hore hagaaji waddadaas. Ma jiro tallaabo dambe oo beddeli karta wace aan gaari karin VNet-ka ama xallin karin magaca.
Tallaabada 2: soo aruuri magaca martigeliyaha dhabta ah iyo cinwaanka gelitaanka
Qor domain-ka caadiga ah ee deegaanka, cinwaankiisa gaarka ah ee go'an ee gelitaanka iyo FQDN-ka app-ka ee la qaabeeyay, oo laga soo qaatay kheyraadka halkii laga soo qaadan lahaa sawir shaashad duug ah ama bog wiki:
az containerapp env show -n ENV -g RG \
--query "{domain:properties.defaultDomain, ip:properties.staticIp}"
az containerapp show -n APP -g RG \
--query "properties.configuration.ingress.fqdn"Hagaha" gelitaanka gaarka ah ee Container Apps" wuxuu sharaxaa sida domain-ka deegaanka loo waafajiyo cinwaankiisa gudaha iyada oo magacyada martigeliyaha ee codsiga aan la taaban. Taasi waa saxda qaabka aad halkan gacanta ku dhisayso, marka ku waafaji waxa ku jira aagga iyada, halkii aad ka hindisay lahaa nidaam magacayn cusub.
Haddii domain-ka aad akhriday aanu u dhigmin FQDN-ka uu app-ku soo sheego, joogsada oo hadda isku waafaji. Aag ku dhisidda daba-galka khaldan waxay soo saartaa magac martigeliye oo si qumman loo xalliyo haddana ku dhaca martigeliyaha farshaxanka ah ee khaldan.
Tallaabada 3: aagga gaarka ah dhig waddada xallin-qaadaha VPN
Abuur ama dib u isticmaal aagga DNS gaarka ah ee la taageeray ee domain-ka caadiga ah ee dhabta ah ee deegaanka, iyada oo diiwaannada wildcard iyo cinwaanka ee la diiwaangeliyay ay tilmaamayaan gelitaanka go'an. Aaggaas ku xir shabakadda farshaxanka ee ku habboon, oo awoodda gaarka ah ka dhig mid la gaari karo iyada oo loo marayo waddada xallin-qaadaha ee la ansixiyay ee VPN, halkii aad ka qaadan lahayd in xidhitaanku ku filan yahay.
Macmiil dhibic-ilaa-goob wuxuu inta badan u baahan yahay barta-dhamaadka soo-gelinta ee xallin-qaade gaar ah ama gudbine DNS la taageeray si uu u gaaro aaggaas. Xidhitaanka aagga waxay beddeshaa waxa Azure u xalliyo shabakadaha xiran; ma leexiso xallin-qaadaha dadweyne ee kombuyuutar kasta oo dibadda ah. Ha ku beddelin aag DNS oo barta-dhamaadka gaarka ah oo laga soo amaahday qaab shabakadeed kale oo Container Apps, maxaa yeelay magacyada diiwaannada iyo daba-galka aaggu isku mid ma noqon doonaan.
Dib-u-noqoshada tallaabadan waa in la tirtiro xidhitaanka aagga ama diiwaanka aad ku dartay. Qor kee baa ahaa labadaas, maxaa yeelay tirtirka aag la wadaago si loo baajiyo hal xidhiidh waa hab caan ah oo lagu jebiyo deegaan labaad.
Tallaabada 4: tijaabi magaca, ka dibna dhagaystayaasha la diiday
Tijaabi magaca martigeliyaha iyo aqoonsiga TLS wada, ma aha cinwaanka oo keliya. Ogaanshaha khariidadaynta magaca oo la kontoroolo waxaad dhigi kartaa cinwaanka iyada oo aad hayso magaca martigeliyaha:
curl --resolve app.ENVIRONMENT_DOMAIN:443:10.40.0.10 \
https://app.ENVIRONMENT_DOMAIN/Ku beddel magaca martigeliyaha FQDN-ka dhabta ah ee app-ka iyo cinwaanka gelitaanka gudaha ee dhabta ah. Tani waxay saameynaysaa kaliya hal codsi oo ma aha bixinta DNS. Ha ku darin -k si aad u beddesho guuldarada aqoonsiga oo u noqoto gudub muuqda, maxaa yeelay ismaandhaafka shahaadadu waa calaamadda inaad ku dhacayso dhagaystaha khaldan.
In si toos ah loo codsado cinwaanka nambarka ah waxay dooran kartaa martigeliyaha farshaxanka ah ee khaldan ama waxay guuldareysan kartaa xaqiijinta xitaa marka TCP 443 uu jawaabo, marka u qaado tijaabada IP ee guulaysatay inay tahay caddayn ku saabsan shabakadda oo aan wax dheeraad ah ahayn. Kombuyuutarka la qaato ee loogu talagalay, waddada caadiga ah ee xallin-qaaduhu waa gudbinta DNS ee macmiilka ama barta-dhamaadka soo-gelinta ee xallin-qaadaha gaarka ah ee martigaliya aagga, guuldarada halkaasna waa dhibaato gaaritaanka xallin-qaadaha ma aha diiwaan maqan. Xaqiiji in isla codsigaas uu guuleysto waddadaas, ka dibna xaqiiji in dhagaystayaasha la diiday ay wali la diiday.
Waxa la diiwaangelinayo iyo waxa dib loo celinayo
Marta-doorka bartilmaameedka weelka iyo marta-doorka HTTPS ee macmiilka waa goobo gaar ah. Ha daabicin bartilmaameedka weelka iyada oo loo marayo VPN sababtoo ah weelku halkaas ayuu dhagaysanayaa, oo ha ballaarin xeer shabakadeed si tijaabada marta-doorku u gudubto. Labada isbeddelba way sii noolaanayaan dhacdada ka dib oo goor dambe way adag tahay in loo nisbeeyo.
Ku dhammee hawlgalka codsi cusub oo ka yimid kombuyuutarka la qaato ee loogu talagalay, iyada oo la isticmaalayo aqoonsigiisa la oggolaaday iyo DNS-kiisa caadiga ah, ka dibna hubi in wace aan la fasixin uu wali guuldareysto. Inta aad ku jirto qaabeynta app-ka, sidoo kale xaqiiji haddii waddo HTTP heer deegaan ah ay app-kan u soo bandhigto bartilmaameed ahaan, maxaa yeelay waddadaas waa albaabka labaad ee baaxadda gelitaanku aanay sharaxin.
Qor shan qiime wada: baaxadda deegaanka, baaxadda gelitaanka app-ka, FQDN, cinwaanka gelitaanka gaarka ah iyo milkiilaha xallin-qaadaha. Shantaas waxay sharaxaan heshiiska gelitaanka oo dhan, qofka xiga ee tan wax ka baaraandegi doonana wuxuu codsan doonaa saxda iyaga.