azure - 如何使用静态出站 IP 配置 Azure ContainerApps？

Question

在 Azure ContainerApps 文档中 Ports and IP Addresses section它表明

Outbound public IP  

Used as the "from" IP for outbound connections that leave the virtual network. These
connections aren't routed down a VPN. Using a NAT gateway or other proxy for outbound
traffic from a Container App environment isn't supported. Outbound IPs aren't guaranteed
and may change over time.

ContainerApps 环境的入站 IP 是固定的。另一方面，Azure 容器实例(不是 ContainerApps)似乎已记录了 configure a static outbound IP via NAT Gateway 的功能。 .

是否也可以为 Azure ContainerApps 配置静态出站 IP？

如果没有，建议长时间运行的后台服务使用哪些替代部署模型？要求是外部服务可以依靠固定的出站 IP(或非常小的范围，而不是 the entire DataCenter IP ranges )进行白名单。

** 编辑 - ACA 似乎尚不支持 VNet 上的 NAT - https://github.com/microsoft/azure-container-apps/issues/522

Answer 1

根据您引用的文档:

Outbound public IP Used as the "from" IP for outbound connections that leave the virtual network. These connections aren't routed down a VPN. Outbound IPs aren't guaranteed and may change over time. Using a NAT gateway or other proxy for outbound traffic from a Container App environment is only supported on the workload profile environment.

因此，您需要使用自定义 vNET 配置将工作负载配置文件附加到您的应用程序: https://learn.microsoft.com/en-us/azure/container-apps/workload-profiles-manage-cli?pivots=aca-vnet-custom&tabs=external-env

之后，我想您可以在该 vnet 中启动 NAT 网关: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-nat-gateway#deploy-a-nat-gateway-into-a-virtual-network

所以步骤是:

创建 vNET

az network vnet create \
  --address-prefixes 13.0.0.0/23 \
  --resource-group "<RESOURCE_GROUP>" \
  --location "<LOCATION>" \
  --name "<VNET_NAME>"

创建子网

az network vnet subnet create \
  --address-prefixes 13.0.0.0/23 \
  --delegations Microsoft.App/environments \
  --name "<SUBNET_NAME>" \
  --resource-group "<RESOURCE_GROUP>" \
  --vnet-name "<VNET_NAME>" \
  --query "id"

创建容器应用环境:

az containerapp env create \
  --enable-workload-profiles \
  --resource-group "<RESOURCE_GROUP>" \
  --name "<NAME>" \
  --location "<LOCATION>"

使用之前的环境创建容器应用

az containerapp create \
  --resource-group "<RESOURCE_GROUP>" \
  --name "<CONTAINER_APP_NAME>" \
  --target-port 80 \
  --ingress external \
  --image mcr.microsoft.com/azuredocs/containerapps-helloworld:latest \
  --environment "<ENVIRONMENT_NAME>" \
  --workload-profile-name "Consumption"

创建公共(public)IP

az network public-ip create \
  --name myPublicIP \
  --resource-group $resourceGroup \
  --sku standard \
  --zone 1 \
  --allocation static

使用该 IP 部署 NAT

az network nat gateway create \
  --resource-group $resourceGroup \
  --name myNATgateway \
  --public-ip-addresses myPublicIP \
  --idle-timeout 10

为子网配置 NAT

az network vnet subnet update \
    --resource-group $resourceGroup  \
    --vnet-name "<VNET_NAME>" \
    --name "<SUBNET_NAME>" \
    --nat-gateway myNATgateway

我尚未测试所有步骤，但这应该是要点。