Finyelela uhlelo lwe-Container Apps oluyimfihlo nge-VPN yephoyinti-kuya-esizeni

Imvelo yangaphakathi ye-Container Apps idinga indawo yokungena eyimfihlo, igama lomsingathi elihambisanayo kanye nesixazululi i-VPN engafinyelela kuso. Qhuba isinyathelo ngasinye, bese uqinisekisa ukwenqatshwa.

Le ncwadi yokuhola ihlanganisa imvelo ye-Container Apps enezincazelo zomthwalo womsebenzi kanye nendawo yokungena yenethiwekhi ebonakalayo yangaphakathi, efinyelelwa kusuka kukhompyutha ephathekayo nge-VPN yephoyinti-kuya-esizeni egunyaziwe, kusetshenziswa i-FQDN eqondile yohlelo futhi kungabikho migudu ye-HTTP ezingeni lemvelo. indawo yokungena yemvelo iyafinyeleleka kusuka kuklayenti, ububanzi bokungena kohlelo buvumela umshayi, futhi igama lomsingathi lixazululwa liye endaweni yokungena eyimfihlo. Isinyathelo ngasinye ngezansi sishiya umphumela oqinisekisekayo kanye nokubuyisela emuva okungathinti lutho ongalushintshanga. Ziqhube ngokulandelana okunikeziwe, ngoba asikho isinyathelo sakamuva esinganxephezela isinqumo sobubanzi esithathwe ngokungalungile esinyathelweni 1.

Ngaphambi kokuthinta i-DNS, cacisa igama elithi yangaphakathi. Kusetshenziswa kulolu mkhiqizo ukubhekisela kububanzi obubili obuhlukene, futhi ukuzishintsha yikhona okuyisizathu esivame kakhulu sokuthi igama elisebenzayo lisehluleka ukubuyisela okuthile okuwusizo.

Isinyathelo 1: nciphisa ububanzi bemvelo kanye nohlelo

Funda ukulungiselelwa kokungena kohlelo ngaphambi kokushintsha noma yisiphi isirekhodi:

SettingBoundary
Internal environmentThe environment entry is reached through its private network arrangement
App with internal ingressCallers from the environment VNet only; a VPN laptop qualifies once it has a route into that VNet and the domain resolves privately
App with external ingress in an internal environmentThe app accepts outside traffic through the environment's private entry

Ukungena kwangaphakathi kuvezwa kusilungelelanisi somthwalo sangaphakathi semvelo ngaphakathi kwe-VNet yemvelo, ngakho umbuzo awukhona wokuthi ikhompyutha ephathekayo ingenye inhlelo yekhontheyna, kodwa ukuthi ingafinyelela yini kuleyo VNet. Iklayenti le-VPN elinomgudu ongena ku-VNet kanye nesizinda esimisiwe semvelo esixazululwa ngesifunda esiyimfihlo iyisishayi esifanelekile, futhi yikho kanye okwakhiwa izinyathelo ezisele. Imvelo yangaphakathi engenandawo yokungena yomphakathi iyiqiniso elihlukile kunohlelo olunokungena kwangaphakathi, futhi ukungena kwangaphandle ezingeni lohlelo akunikezi imvelo umnyango womphakathi. Bhala ububanzi kuthikithi nakuphothali, ngoba unjiniyela olandelayo ufunda ithikithi kuqala.

Qinisekisa lobo bubanzi nomnikazi wokulungiselelwa ngaphambi kokuqhubeka, futhi gcina isango lincane: uma kungekho mgudu ongena ku-VNet yemvelo, noma isizinda esimisiwe semvelo singaxazululeki ngesifunda esiyimfihlo, yima bese ulungisa lowo mgudu kuqala. Asikho isinyathelo sakamuva esingathatha indawo yomshayi ongakwazi ukufinyelela i-VNet noma ukuxazulula igama.

Isinyathelo 2: qoqa igama lomsingathi langempela kanye nekheli lokungena

Rekhoda isizinda esimisiwe semvelo, ikheli lalo lokungena eliyimfihlo elimile kanye ne-FQDN ehleliwe yohlelo, ethathwe kusisetshenziswa hhayi kusithombe sesikrini esidala noma ikhasi le-wiki:

az containerapp env show -n ENV -g RG \
  --query "{domain:properties.defaultDomain, ip:properties.staticIp}"
az containerapp show -n APP -g RG \
  --query "properties.configuration.ingress.fqdn"

Iziqondiso ze- ndlela yokungena eyimfihlo ye-Container Apps zichaza ukufanisa isizinda semvelo nekheli lalo langaphakathi kuyilapho amagama omsingathi wohlelo ehlala engathintekile. Yilo kanye umumo oyakhayo ngesandla lapha, ngakho vumelanisa okuqukethwe kwesifunda nakho esikhundleni sokuqamba uhlelo olusha lwamagama.

Uma isizinda osifundile singafani ne-FQDN ebikwa uhlelo, yima bese uwavumelanisa manje. Ukwakha isifunda esisekelweni esingalungile kukhiqiza igama lomsingathi elixazululeka ngokuphelele futhi lihlale ehla kumsingathi obonakalayo ongalungile.

Isinyathelo 3: beka isifunda esiyimfihlo emgudwini wesixazululi we-VPN

Dala noma uphinde usebenzise isifunda se-DNS esiyimfihlo esisekelwayo sesizinda sangempela esimisiwe semvelo, kanye namarekhodi e-wildcard nekheli abhaliwe akhomba endaweni yokungena emile. Xhumanisa leso sifunda nenethiwekhi ebonakalayo efanele, futhi wenze igunya eliyimfihlo lifinyeleleke ngomgudu wesixazululi ogunyaziwe we-VPN esikhundleni sokucabanga ukuthi ukuxhumana kwanele.

Iklayenti lephoyinti-kuya-esizeni ngokuvamile lidinga iphoyinti lokugcina lokungena lesixazululi esiyimfihlo noma isidlulisi se-DNS esisekelwayo ukuze lifinyelele leso sifunda. Ukuxhumanisa isifunda kushintsha lokho i-Azure ekuxazululayo kumanethiwekhi axhunyiwe; akukuhambisi kabusha isixazululi somphakathi sakho konke ukhompyutha ephathekayo yangaphandle. Ungakushintshi ngesifunda se-DNS sephoyinti lokugcina eliyimfihlo elibolekwe kwelinye imodeli yenethiwekhi ye-Container Apps, ngoba amagama amarekhodi kanye nesijobelelo sesifunda ngeke kuvumelane.

Ukubuyisela emuva kwalesi sinyathelo ukususa ukuxhumana kwesifunda noma irekhodi owengezile. Bhala ukuthi yikuphi kulokhu okubili, ngoba ukususa isifunda esabelwana ngaso ukuze uhoxise ukuxhumana okukodwa kuyindlela eyaziwayo yokwephula imvelo yesibili.

Isinyathelo 4: hlola igama, bese uhlola izethameli ezenqatshiwe

Hlola igama lomsingathi kanye nobuwena be-TLS ndawonye, hhayi ikheli kuphela. Ukuze uthole ukuxilongwa kokuhlelwa kwamagama okulawulwayo ungabophela ikheli kuyilapho ugcina igama lomsingathi:

curl --resolve app.ENVIRONMENT_DOMAIN:443:10.40.0.10 \
    https://app.ENVIRONMENT_DOMAIN/

Shintsha igama lomsingathi nge-FQDN yangempela yohlelo nekheli ngendawo yokungena yangaphakathi yangempela. Lokhu kuthinta leso sicelo esisodwa kuphela futhi akukona ukuhlinzekwa kwe-DNS. Ungafaki -k ukuze uguqule ukwehluleka kobuwena kube ukuphumelela okubonakalayo, ngoba ukungavumelani kwesitifiketi wuphawu lokuthi ushaya isilaleli esingalungile.

Ukucela ikheli lezinombolo ngokuqondile kungase kukhethe umsingathi obonakalayo ongalungile noma kwenze ukuqinisekiswa kwehluleke ngisho noma i-TCP 443 iphendula, ngakho thatha ukuhlolwa kwe-IP okuphumelelayo njengobufakazi mayelana nenethiwekhi hhayi okunye. Kusuka kukhompyutha ephathekayo ehlosiwe, umgudu ojwayelekile wesixazululi isidlulisi se-DNS seklayenti noma iphoyinti lokugcina lokungena lesixazululi esiyimfihlo esisingatha isifunda, futhi ukwehluleka lapho kuyinkinga yokufinyeleleka kwesixazululi, hhayi irekhodi elilahlekile. Qinisekisa ukuthi isicelo esifanayo siyaphumelela kulo mgudu, bese uqinisekisa ukuthi izethameli ezenqatshiwe zisenqatshiwe.

Okufanele kurekhodwe nokufanele kubuyiselwe emuva

Iphothi elihlosiwe lekhontheyna nephothi le-HTTPS leklayenti kuyizilungiselelo ezihlukene. Ungashicileli iphothi elihlosiwe lekhontheyna nge-VPN ngoba ikhontheyna ilalela lapho, futhi ungandisi umthetho wenethiwekhi ukuze ukuhlolwa kwephothi kudlule. Zombili izinguquko ziphila ngemuva kwesigameko futhi kamuva kunzima ukuzihlobanisa.

Qeda ngokusebenza kohlelo okusha kusuka kukhompyutha ephathekayo ehlosiwe, kusetshenziswa ubuwena obugunyaziwe kanye ne-DNS evamile, bese uhlola ukuthi umshayi ongagunyaziwe usahluleka. Ngesikhathi usemisebenzini yokulungiselela uhlelo, qinisekisa futhi ukuthi umgudu we-HTTP ezingeni lemvelo uveza lolu hlelo njengomgomo, ngoba lowo mgudu uwumnyango wesibili ongachazwanga ububanzi bokungena.

Rekhoda amanani amahlanu ndawonye: ububanzi bemvelo, ububanzi bokungena kohlelo, i-FQDN, ikheli lokungena eliyimfihlo kanye nomnikazi wesixazululi. Lawo mahlanu achaza yonke inkontileka yokufinyelela, futhi umuntu olandelayo ozolungisa lokhu uzocela wona kanye.

Izihloko ezihlobene