Map DNS names to applications in multiple Azure Spring Apps service instances in the same virtual network

Note

The Basic, Standard, and Enterprise plans will be deprecated starting from mid-March, 2025, with a 3 year retirement period. We recommend transitioning to Azure Container Apps. For more information, see the Azure Spring Apps retirement announcement.

The Standard consumption and dedicated plan will be deprecated starting September 30, 2024, with a complete shutdown after six months. We recommend transitioning to Azure Container Apps. For more information, see Migrate Azure Spring Apps Standard consumption and dedicated plan to Azure Container Apps.

This article applies to: ✅ Basic/Standard ✅ Enterprise

This article shows how to map Domain Name System (DNS) names to applications to access multiple Azure Spring Apps service instances in the same virtual network.

Prerequisites

• An Azure subscription. If you don't have a subscription, create a free account before you begin.
• Azure CLI version 2.45.0 or higher. Use the following command to install the Azure Spring Apps extension: az extension add --name spring
• A virtual network deployed in an instance of Azure Spring Apps. For more information, see Deploy Azure Spring Apps in your Azure virtual network (VNet injection).

Overview

This article describes the following two approaches for mapping DNS names to applications:

• Using the Microsoft-provided fully qualified domain name (FQDN).

  This approach is a relatively simple and lightweight way to map DNS names compared to the custom domain approach. This approach is recommended if you don't need a wildcard approach in your DNS zone.

  This approach requires a DNS record for each application.

• Using a custom domain.

  If you already have a custom domain or you want a wildcard approach to work in a multi-instance scenario, use this approach.

  This approach requires a DNS record for each Azure Spring Apps service instance, and a custom domain configured for each application.

As an example, this article uses azure-spring-apps-1 and azure-spring-apps-2 as the names of two Azure Spring Apps instances in the same virtual network.

Begin with the Preliminary steps for DNS mapping section and then proceed with your preferred approach:

• DNS mapping with Microsoft-provided FQDN
• DNS mapping with a custom domain

End by testing the mapping as described in the Access private FQDN URLs for private applications section.

Preliminary steps for DNS mapping

Complete the steps in this section for both the FQDN and the custom domain approaches to mapping DNS names.

Find application IP addresses

Both approaches require the IP address for each application in the Azure Spring Apps instance you want to map. Use the following steps to find the IP addresses:

Azure portal

1. Navigate to the virtual network you created for an Azure Spring Apps instance, and then select Connected devices in the navigation pane.

2. On the Connected devices page, search for kubernetes-internal.

3. In the search results, find each Device connected to a service runtime Subnet of an Azure Spring Apps service instance, and copy its IP Address. In the following screenshot example, the IP address of azure-spring-apps-1 is 10.1.0.6, and the IP address of azure-spring-apps-2 is 10.1.2.6.

   

Azure CLI

1. Use the following commands to define variables for your subscription, resource group, Azure Spring Apps instance, and virtual network. Customize the values based on your environment.

   export SUBSCRIPTION='<subscription-ID>'
   export RESOURCE_GROUP='<resource-group-name>'
   export AZURE_SPRING_APPS_NAME='<Azure-Spring-Apps-instance-name>'
   export VIRTUAL_NETWORK_NAME='<Azure-Spring-Apps-VNET-name>'
   

2. Use the following commands to set the variables for the service runtime network resource group and the IP address:

   export SERVICE_RUNTIME_RG=$(az spring show \
       --resource-group $RESOURCE_GROUP \
       --name $AZURE_SPRING_APPS_NAME \
       --query "properties.networkProfile.serviceRuntimeNetworkResourceGroup" \
       --output tsv)
   export IP_ADDRESS=$(az network lb frontend-ip list \
       --lb-name kubernetes-internal \
       --resource-group $SERVICE_RUNTIME_RG \
       --query "[0].privateIpAddress" \
       --output tsv)
   

Create a private DNS zone

Use the following steps to create a private DNS zone for an application in the private network.

Note

If you're using Microsoft Azure operated by 21Vianet, replace private.azuremicroservices.io with private.microservices.azure.cn in this article. For more information, see Check Endpoints in Azure.

Azure portal

1. On the Azure Home page, search for Private DNS zones.

2. On the Private DNS zones page, select Create.

3. Fill out the form on the Create Private DNS zone page. In Instance details for Name, specify private.azuremicroservices.io as the name of the private DNS zone.

4. Select Review create.

5. Select Create.

Azure CLI

1. Use the following commands to sign in to the Azure CLI and set your active subscription:

   az login
   az account set --subscription ${SUBSCRIPTION}
   

2. Use the following command to create the private DNS zone.

   az network private-dns zone create \
       --resource-group $RESOURCE_GROUP \
       --name private.azuremicroservices.io
   

It may take a few minutes to create the zone.

Link the virtual network

To link the private DNS zone you created to the virtual network, you must create a virtual network link.

Azure portal

Use the following steps to create this link:

1. Navigate to the private DNS zone you created named private.azuremicroservices.io. There might be several with that name, so determine the correct one by its resource group and subscription.

2. On the navigation pane, select Virtual network links, then select Add.

3. For the Link name, enter azure-spring-apps-dns-link.

4. For Virtual network, select the virtual network you created for Prerequisites.

   

5. Select OK.

Azure CLI

Use the following command to create this link:

az network private-dns link vnet create \
    --resource-group $RESOURCE_GROUP \
    --name azure-spring-apps-dns-link \
    --zone-name private.azuremicroservices.io \
    --virtual-network $VIRTUAL_NETWORK_NAME \
    --registration-enabled false

Assign a private FQDN for your applications

Assign a private FQDN for your application.

Azure portal

Use the following steps to update your app with an assigned endpoint:

1. Navigate to the Azure Spring Apps instance deployed in your virtual network, and then select Apps in the navigation pane.

2. Select an application.

3. Select Assign Endpoint to assign a private FQDN to your application. Assigning an FQDN can take a few minutes.

   

4. Repeat these steps for each application you want to map.

Azure CLI

Use the following command to update your app with an assigned endpoint. Customize the value of your app name based on your real environment.

export SPRING_CLOUD_APP='<app-name>'
az spring app update \
    --resource-group $RESOURCE_GROUP \
    --name $SPRING_CLOUD_APP \
    --service $SPRING_CLOUD_NAME \
    --assign-endpoint true

DNS mapping with a Microsoft-provided FQDN

Using this approach, you must create a DNS record for each application as a requirement when using the Microsoft-provided fully qualified domain name (FQDN). For a core understanding of this process, see Access your application in a private network.

When an application in an Azure Spring Apps service instance with assigned endpoint is deployed in the virtual network, the endpoint is a private FQDN. By default, the fully qualified domain name is unique for each app across service instances. The FQDN format is <service-name>-<app-name>.private.azuremicroservices.io.

Create DNS records for all the applications

To use the private DNS zone to translate and resolve DNS names, you must create an "A" type record in the zone for each of your applications. In this example, the app name is hello-vnet and the Azure Springs Apps service instance name is azure-spring-apps-1.

You need the IP address for each application. Copy it as described in the Find the IP address for your application section of Access your application in a private network. In this example, the IP address is 10.1.0.6.

Azure portal

Use the following steps to create a DNS record:

1. Navigate to the private DNS zone you created earlier: private.azuremicroservices.io

2. Select Record set.

3. In the Add record set pane, enter the values from the following table.

   Setting	Value
   Name	azure-spring-apps-1-hello-vnet
   Type	A
   TTL	1
   TTL unit	Hours
   IP address	(paste from the clipboard)

4. Select OK.

   

Azure CLI

Use the following command to create a DNS record:

az network private-dns record-set a add-record \
    --resource-group $RESOURCE_GROUP \
    --zone-name private.azuremicroservices.io \
    --record-set-name 'azure-spring-apps-1-hello-vnet' \
    --ipv4-address $IP_ADDRESS

Repeat these steps as needed to add a DNS record for other applications.

DNS mapping with a custom domain

Using this approach, you only need to add a DNS record for each Azure Spring Apps instance, but you must configure the custom domain for each application. For a core understanding of this process, see Map an existing custom domain to Azure Spring Apps.

This example reuses the private DNS zone private.azuremicroservices.io to add a custom domain related DNS record. The private FQDN has the format <app-name>.<service-name>.private.azuremicroservices.io.

Technically, you can use any private fully qualified domain name you want. In that case, you have to create a new private DNS zone corresponding to the fully qualified domain name you choose.

Map your custom domain to an app in an Azure Spring Apps instance

Use the following steps to map your custom domain to each of the applications in the Azure Spring Apps instance:

Azure portal

1. Open the Azure Spring Apps instance and select Apps in the navigation pane.

2. On the Apps page, select an application.

3. Select Custom domain in the navigation pane.

4. Select Add Custom domain.

5. On the Add custom domain pane, enter the FQDN you want to use and make sure it corresponds to the certificate to use for TLS/SSL binding later. This example uses hello-vnet.azure-spring-apps-1.private.azuremicroservices.io. You can disregard the CNAME part.

6. Select Validate.

7. If validated, select Add.

   

When the custom domain is successfully mapped to the app, it appears in the custom domain table.

Azure CLI

1. Use the following command to bind a custom domain to an app:

   az spring app custom-domain bind \
       --resource-group <resource-group-name> \
       --service <Azure-Spring-Apps-instance-name> \
       --domain-name <fqdn-domain-name> \
       --app <app-name>
   

2. Use the following command to list all custom domains of an app:

   az spring app custom-domain list \
       --resource-group <resource-group-name> \
       --service <Azure-Spring-Apps-instance-name> \
       --app <app-name> \
   

Note

A TLS/SSL state value of Not Secure for your custom domain means that it's not yet bound to a TLS/SSL certificate. Any HTTPS request from a browser to your custom domain will receive an error or warning.

Add TLS/SSL binding

Before doing this step, make sure you've prepared your certificates and imported them into Azure Spring Apps. For more information, see Map an existing custom domain to Azure Spring Apps.

Azure portal

Use the following steps to update the custom domain of an app with a certificate:

1. Open the Azure Spring Apps instance and select Apps in the navigation pane.

2. On the Apps page, select an application.

3. Select Custom domain in the navigation pane.

4. Select the ellipsis (...) button for a custom domain and then select Bind TLS/SSL.

5. On the TLS/SSL binding pane, select Certificate and then select or import the certificate.

6. Select Save.

   

After you successfully add TLS/SSL binding, the domain state will be secure, as shown by a TLS/SSL state value of Healthy.

Azure CLI

Use the following command to update the custom domain of an app with a certificate:

az spring app custom-domain update \
    --resource-group <resource-group-name> \
    --service <Azure-Spring-Apps-instance-name> \
    --domain-name <domain-name> \
    --certificate <cert-name> \
    --app <app-name> 

Configure the custom domain for all applications

To use the private DNS zone to translate and resolve DNS names, you must create an "A" type record in the zone for each of your Azure Spring Apps service instances. In this example, the app name is hello-vnet and the Azure Springs Apps service instance name is azure-spring-apps-1.

You need the IP address for each application. Copy it as described in the Find the IP address for your application section of Access your application in a private network. In this example, the IP address is 10.1.0.6.

Azure portal

Use the following steps to create the A record in your DNS zone:

1. Navigate to the private DNS zone you created earlier: private.azuremicroservices.io

2. Select Record set.

3. In the Add record set pane, enter the values from the following table.

   Setting	Value
   Name	*.azure-spring-apps-1
   Type	A
   TTL	1
   TTL unit	Hours
   IP address	(paste from the clipboard)

4. Select OK.

   

Azure CLI

Use the following command to create the A record in your DNS zone:

az network private-dns record-set a add-record \
    --resource-group $RESOURCE_GROUP \
    --zone-name private.azuremicroservices.io \
    --record-set-name '*.azure-spring-apps-1' \
    --ipv4-address $IP_ADDRESS

Repeat as needed to configure the custom domain for other applications.

Access private FQDN for applications

After the FQDN assignments and DNS mappings for both approaches, you can access all the applications' private FQDN in the private network. For example, you can create a jumpbox or virtual machine in the same virtual network or in a peered virtual network and have access to all the private FQDNs of the applications.

The following examples show the FQDN approach:

• https://hello-vnet.azure-spring-apps-1.private.azuremicroservices.io
• https://hello-vnet.azure-spring-apps-2.private.azuremicroservices.io

The following examples show the custom domain approach:

• https://azure-spring-apps-1-hello-vnet.private.azuremicroservices.io
• https://azure-spring-apps-2-hello-vnet.private.azuremicroservices.io

The following screenshot shows the URL for a Spring application using an FQDN:

The following screenshot shows the URL for a Spring application using a custom domain:

Clean up resources

If you plan to continue working with subsequent articles, you might want to leave these resources in place. When no longer needed, delete the resource group, which deletes the resources in the resource group. To delete the resource group by using Azure CLI, use the following command:

az group delete --name $RESOURCE_GROUP

Next steps

• Deploy Azure Spring Apps in your Azure virtual network (VNet injection)
• Access your application in a private network