Provide a virtual network to an internal Azure Container Apps environment

The following example shows you how to create a Container Apps environment in an existing virtual network.

Begin by signing in to the Azure portal.

Create a container app

To create your container app, start at the Azure portal home page.

1. Search for Container Apps in the top search bar.
2. Select Container Apps in the search results.
3. Select the Create button.

Basics tab

In the Basics tab, do the following actions.

1. Enter the following values in the Project details section.

   Setting	Action
   Subscription	Select your Azure subscription.
   Resource group	Select Create new and enter my-container-apps.
   Container app name	Enter my-container-app.
   Deployment source	Select Container image.

Create an environment

Next, create an environment for your container app.

1. Select the appropriate region.

   Setting	Value
   Region	Select Central US.

2. In the Create Container Apps environment field, select the Create new link.

3. In the Create Container Apps environment page on the Basics tab, enter the following values:

   Setting	Value
   Environment name	Enter my-environment.
   Environment type	Select Workload profiles.
   Zone redundancy	Select Disabled

4. Select the Monitoring tab to create a Log Analytics workspace.

5. Select Azure Log Analytics as the Logs Destination.

6. Select the Create new link in the Log Analytics workspace field and enter the following values.

   Setting	Value
   Name	Enter my-container-apps-logs.

   The Location field is prefilled with Central US for you.

7. Select OK.

Note

You can use an existing virtual network, but a dedicated subnet with a CIDR range of /23 or larger is required for use with Container Apps when using the Consumption only environment. When using the workload profiles environment, a /27 or larger is required. To learn more about subnet sizing, see the networking environment overview.

7. Select the Networking tab to create a VNET.

8. Select Yes next to Use your own virtual network.

9. Next to the Virtual network box, select the Create new link and enter the following value.

   Setting	Value
   Name	Enter my-custom-vnet.

10. Select the OK button.

11. Next to the Infrastructure subnet box, select the Create new link and enter the following values:

    Setting	Value
    Subnet Name	Enter infrastructure-subnet.
    Virtual Network Address Block	Keep the default values.
    Subnet Address Block	Keep the default values.

12. Select the OK button.

13. Under Virtual IP, select Internal.

14. Select Create.

Deploy the container app

1. Select Review and create at the bottom of the page.

   If no errors are found, the Create button is enabled.

   If there are errors, any tab containing errors is marked with a red dot. Navigate to the appropriate tab. Fields containing an error are highlighted in red. Once all errors are fixed, select Review and create again.

2. Select Create.

   A page with the message Deployment is in progress is displayed. Once the deployment is successfully completed, you see the message: Your deployment is complete.

Prerequisites

• Azure account with an active subscription.
  • If you don't have one, you can create one for free.
• Install the Azure CLI version 2.28.0 or higher.

Setup

To sign in to Azure from the CLI, run the following command and follow the prompts to complete the authentication process.

Bash

az login

Azure PowerShell

Connect-AzAccount

To ensure you're running the latest version of the CLI, run the upgrade command.

Bash

az upgrade

Azure PowerShell

Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force

Ignore any warnings about modules currently in use.

Next, install or update the Azure Container Apps extension for the CLI.

If you receive errors about missing parameters when you run az containerapp commands in Azure CLI or cmdlets from the Az.App module in Azure PowerShell, be sure you have the latest version of the Azure Container Apps extension installed.

Bash

az extension add --name containerapp --upgrade

Note

Starting in May 2024, Azure CLI extensions no longer enable preview features by default. To access Container Apps preview features, install the Container Apps extension with --allow-preview true.

az extension add --name containerapp --upgrade --allow-preview true

Azure PowerShell

Install-Module -Name Az.App

Make sure to update the Az.App module to the latest version.

Update-Module -Name Az.App

Now that the current extension or module is installed, register the Microsoft.App and Microsoft.OperationalInsights namespaces.

Bash

az provider register --namespace Microsoft.App

az provider register --namespace Microsoft.OperationalInsights

Azure PowerShell

Register-AzResourceProvider -ProviderNamespace Microsoft.App

Register-AzResourceProvider -ProviderNamespace Microsoft.OperationalInsights

Set environment variables

Set the following environment variables. Replace <PLACEHOLDERS> with your values:

Bash

RESOURCE_GROUP="<RESOURCE_GROUP>"
LOCATION="<LOCATION>"
CONTAINERAPPS_ENVIRONMENT="<CONTAINERAPPS_ENVIRONMENT>"

Azure PowerShell

$ResourceGroupName = '<RESOURCE_GROUP>'
$Location = '<LOCATION>'
$ContainerAppsEnvironment = '<CONTAINERAPPS_ENVIRONMENT>'

Create an Azure resource group

Create a resource group to organize the services related to your container app deployment.

Bash

az group create \
  --name $RESOURCE_GROUP \
  --location "$LOCATION"

Azure PowerShell

New-AzResourceGroup -Location $Location -Name $ResourceGroupName

Create an environment

An environment in Azure Container Apps creates a secure boundary around a group of container apps. Container Apps deployed to the same environment are deployed in the same virtual network and write logs to the same Log Analytics workspace.

Register the Microsoft.ContainerService provider.

Bash

az provider register --namespace Microsoft.ContainerService

Azure PowerShell

Register-AzResourceProvider -ProviderNamespace Microsoft.ContainerService

Declare a variable to hold the VNET name.

Bash

VNET_NAME="my-custom-vnet"

Azure PowerShell

$VnetName = 'my-custom-vnet'

Now create an instance of the virtual network to associate with the Container Apps environment. The virtual network must have two subnets available for the container app instance.

Note

Network subnet address prefix requires a minimum CIDR range of /23 for use with Container Apps when using the Consumption only environment. When using the Workload Profiles environment, a /27 or larger is required. To learn more about subnet sizing, see the networking environment overview.

Bash

az network vnet create \
  --resource-group $RESOURCE_GROUP \
  --name $VNET_NAME \
  --location $LOCATION \
  --address-prefix 10.0.0.0/16

az network vnet subnet create \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name infrastructure-subnet \
  --address-prefixes 10.0.0.0/23

Azure PowerShell

$SubnetArgs = @{
    Name = 'infrastructure-subnet'
    AddressPrefix = '10.0.0.0/23'
}
$subnet = New-AzVirtualNetworkSubnetConfig @SubnetArgs

$VnetArgs = @{
    Name = $VnetName
    Location = $Location
    ResourceGroupName = $ResourceGroupName
    AddressPrefix = '10.0.0.0/16'
    Subnet = $subnet
}
$vnet = New-AzVirtualNetwork @VnetArgs

When using the Workload profiles environment, you need to update the VNET to delegate the subnet to Microsoft.App/environments. This delegation is not applicable to the Consumption-only environment.

Bash

az network vnet subnet update \
  --resource-group $RESOURCE_GROUP \
  --vnet-name $VNET_NAME \
  --name infrastructure-subnet \
  --delegations Microsoft.App/environments

Azure PowerShell

$delegation = New-AzDelegation -Name 'containerApp' -ServiceName 'Microsoft.App/environments'
$vnet = Set-AzVirtualNetworkSubnetConfig -Name $SubnetArgs.Name -VirtualNetwork $vnet -AddressPrefix $SubnetArgs.AddressPrefix -Delegation $delegation
$vnet | Set-AzVirtualNetwork

With the VNET established, you can now query for the infrastructure subnet ID.

Bash

INFRASTRUCTURE_SUBNET=`az network vnet subnet show --resource-group ${RESOURCE_GROUP} --vnet-name $VNET_NAME --name infrastructure-subnet --query "id" -o tsv | tr -d '[:space:]'`

Azure PowerShell

$InfrastructureSubnet = (Get-AzVirtualNetworkSubnetConfig -Name $SubnetArgs.Name -VirtualNetwork $vnet).Id

Finally, create the Container Apps environment with the VNET and subnet.

Bash

az containerapp env create \
  --name $CONTAINERAPPS_ENVIRONMENT \
  --resource-group $RESOURCE_GROUP \
  --location "$LOCATION" \
  --infrastructure-subnet-resource-id $INFRASTRUCTURE_SUBNET \
  --internal-only

The following table describes the parameters used in for containerapp env create.

Parameter	Description
name	Name of the Container Apps environment.
resource-group	Name of the resource group.
logs-workspace-id	(Optional) The ID of an existing the Log Analytics workspace. If omitted, a workspace is created for you.
logs-workspace-key	The Log Analytics client secret. Required if using an existing workspace.
location	The Azure location where the environment is to deploy.
infrastructure-subnet-resource-id	Resource ID of a subnet for infrastructure components and user application containers.
internal-only	(Optional) The environment doesn't use a public static IP, only internal IP addresses available in the custom VNET. (Requires an infrastructure subnet resource ID.)

With your environment created using your custom virtual network, you can deploy container apps into the environment using the az containerapp create command.

Azure PowerShell

A Log Analytics workspace is required for the Container Apps environment. The following commands create a Log Analytics workspace and save the workspace ID and primary shared key to environment variables.

$WorkspaceArgs = @{
    Name = 'myworkspace'
    ResourceGroupName = $ResourceGroupName
    Location = $Location
    PublicNetworkAccessForIngestion = 'Enabled'
    PublicNetworkAccessForQuery = 'Enabled'
}
New-AzOperationalInsightsWorkspace @WorkspaceArgs
$WorkspaceId = (Get-AzOperationalInsightsWorkspace -ResourceGroupName $ResourceGroupName -Name $WorkspaceArgs.Name).CustomerId
$WorkspaceSharedKey = (Get-AzOperationalInsightsWorkspaceSharedKey -ResourceGroupName $ResourceGroupName -Name $WorkspaceArgs.Name).PrimarySharedKey

To create the environment, run the following command:

$EnvArgs = @{
    EnvName = $ContainerAppsEnvironment
    ResourceGroupName = $ResourceGroupName
    Location = $Location
    AppLogConfigurationDestination = 'log-analytics'
    LogAnalyticConfigurationCustomerId = $WorkspaceId
    LogAnalyticConfigurationSharedKey = $WorkspaceSharedKey
    VnetConfigurationInfrastructureSubnetId = $InfrastructureSubnet
    VnetConfigurationInternal = $true
}
New-AzContainerAppManagedEnv @EnvArgs

The following table describes the parameters used in for New-AzContainerAppManagedEnv.

Parameter	Description
EnvName	Name of the Container Apps environment.
ResourceGroupName	Name of the resource group.
LogAnalyticConfigurationCustomerId	The ID of an existing the Log Analytics workspace.
LogAnalyticConfigurationSharedKey	The Log Analytics client secret.
Location	The Azure location where the environment is to deploy.
VnetConfigurationInfrastructureSubnetId	Resource ID of a subnet for infrastructure components and user application containers.
VnetConfigurationInternal	(Optional) The environment doesn't use a public static IP, only internal IP addresses available in the custom VNET. (Requires an infrastructure subnet resource ID.)

With your environment created using your custom virtual network, you can deploy container apps into the environment.

Optional configuration

You have the option of deploying a private DNS and defining custom networking IP ranges for your Container Apps environment.

Deploy with a private DNS

If you want to deploy your container app with a private DNS, run the following commands.

First, extract identifiable information from the environment.

Bash

ENVIRONMENT_DEFAULT_DOMAIN=`az containerapp env show --name ${CONTAINERAPPS_ENVIRONMENT} --resource-group ${RESOURCE_GROUP} --query properties.defaultDomain --out json | tr -d '"'`

ENVIRONMENT_STATIC_IP=`az containerapp env show --name ${CONTAINERAPPS_ENVIRONMENT} --resource-group ${RESOURCE_GROUP} --query properties.staticIp --out json | tr -d '"'`

VNET_ID=`az network vnet show --resource-group ${RESOURCE_GROUP} --name ${VNET_NAME} --query id --out json | tr -d '"'`

Azure PowerShell

$EnvironmentDefaultDomain = (Get-AzContainerAppManagedEnv -EnvName $ContainerAppsEnvironment -ResourceGroupName $ResourceGroupName).DefaultDomain

$EnvironmentStaticIp = (Get-AzContainerAppManagedEnv -EnvName $ContainerAppsEnvironment -ResourceGroupName $ResourceGroupName).StaticIp

Next, set up the private DNS.

Bash

az network private-dns zone create \
  --resource-group $RESOURCE_GROUP \
  --name $ENVIRONMENT_DEFAULT_DOMAIN

az network private-dns link vnet create \
  --resource-group $RESOURCE_GROUP \
  --name $VNET_NAME \
  --virtual-network $VNET_ID \
  --zone-name $ENVIRONMENT_DEFAULT_DOMAIN -e true

az network private-dns record-set a add-record \
  --resource-group $RESOURCE_GROUP \
  --record-set-name "*" \
  --ipv4-address $ENVIRONMENT_STATIC_IP \
  --zone-name $ENVIRONMENT_DEFAULT_DOMAIN

Azure PowerShell

New-AzPrivateDnsZone -ResourceGroupName $ResourceGroupName -Name $EnvironmentDefaultDomain

New-AzPrivateDnsVirtualNetworkLink -ResourceGroupName $ResourceGroupName -Name $VnetName -VirtualNetwork $Vnet -ZoneName $EnvironmentDefaultDomain -EnableRegistration

$DnsRecords = @()
$DnsRecords += New-AzPrivateDnsRecordConfig -Ipv4Address $EnvironmentStaticIp

$DnsRecordArgs = @{
    ResourceGroupName = $ResourceGroupName
    ZoneName = $EnvironmentDefaultDomain
    Name = '*'
    RecordType = 'A'
    Ttl = 3600
    PrivateDnsRecords = $DnsRecords
}
New-AzPrivateDnsRecordSet @DnsRecordArgs

Networking parameters

There are three optional networking parameters you can choose to define when calling containerapp env create. Use these options when you have a peered VNET with separate address ranges. Explicitly configuring these ranges ensures the addresses used by the Container Apps environment don't conflict with other ranges in the network infrastructure.

You must either provide values for all three of these properties, or none of them. If they aren’t provided, the values are generated for you.

Bash

Parameter	Description
platform-reserved-cidr	The address range used internally for environment infrastructure services. Must have a size between /23 and /12 when using the Consumption only environment
platform-reserved-dns-ip	An IP address from the platform-reserved-cidr range that is used for the internal DNS server. The address can't be the first address in the range, or the network address. For example, if platform-reserved-cidr is set to 10.2.0.0/16, then platform-reserved-dns-ip can't be 10.2.0.0 (the network address), or 10.2.0.1 (infrastructure reserves use of this IP). In this case, the first usable IP for the DNS would be 10.2.0.2.
docker-bridge-cidr	The address range assigned to the Docker bridge network. This range must have a size between /28 and /12.

• The platform-reserved-cidr and docker-bridge-cidr address ranges can't conflict with each other, or with the ranges of either provided subnet. Further, make sure these ranges don't conflict with any other address range in the VNET.

• If these properties aren’t provided, the CLI autogenerates the range values based on the address range of the VNET to avoid range conflicts.

Azure PowerShell

Parameter	Description
VnetConfigurationPlatformReservedCidr	The address range used internally for environment infrastructure services. Must have a size between /23 and /12 when using the Consumption only environment
VnetConfigurationPlatformReservedDnsIP	An IP address from the VnetConfigurationPlatformReservedCidr range that is used for the internal DNS server. The address can't be the first address in the range, or the network address. For example, if VnetConfigurationPlatformReservedCidr is set to 10.2.0.0/16, then VnetConfigurationPlatformReservedDnsIP can't be 10.2.0.0 (the network address), or 10.2.0.1 (infrastructure reserves use of this IP). In this case, the first usable IP for the DNS would be 10.2.0.2.
VnetConfigurationDockerBridgeCidr	The address range assigned to the Docker bridge network. This range must have a size between /28 and /12.

• The VnetConfigurationPlatformReservedCidr and VnetConfigurationDockerBridgeCidr address ranges can't conflict with each other, or with the ranges of either provided subnet. Further, make sure these ranges don't conflict with any other address range in the VNET.

• If these properties aren’t provided, the range values are autogenerated based on the address range of the VNET to avoid range conflicts.

Clean up resources

If you're not going to continue to use this application, you can delete the Azure Container Apps instance and all the associated services by removing the my-container-apps resource group. Deleting this resource group removes the resource group automatically created by the Container Apps service containing the custom network components.

Caution

The following command deletes the specified resource group and all resources contained within it. If resources outside the scope of this guide exist in the specified resource group, they will also be deleted.

Bash

az group delete --name $RESOURCE_GROUP

Azure PowerShell

Remove-AzResourceGroup -Name $ResourceGroupName -Force

Additional resources

• To use VNET-scope ingress, you must set up DNS.

Next steps

Managing autoscaling behavior