将静态公共地址分配给 Azure 容器实例部署 [英] Assign Static Public Address to Azure Container Instance deployment

问题描述

上下文

正在开展一个项目，以部署一个 RESTful API 应用程序并将 TCP 服务分开到 Azure 容器实例.由于遗留原因，TCP 服务需要静态 IPv4 地址.

问题

我正在尝试隔离我的选项，以将其作为静态公共 IP 地址分配给托管在 Azure 容器实例上的 TCP 服务.有哪些选择?

测试

1. 使用静态公共 IP 地址部署 Azure 应用程序网关.应用程序网关允许将后端池定向到 IP 或 FQDN 端点.这似乎是可操作的(见图).尽管后端池中的选项似乎只允许 HTTP 和 HTTPS，而不是自定义端口.如果 TCP 服务可以侦听 80 和 443 上的 Web API，也许可以对此进行操作.应用网关是第 7 层资源，仅用于 HTTP 和 HTTPS 流量.

2. Azure 负载均衡器.只能针对 VM、可用性集或 VM 规模集.

3. 为资源分配静态地址.不允许用于容器实例.

4. 流量管理器.似乎不是此部署的正确资源类型.

见图表.当我通过 BASH 会话查询时，API 和 TCP SERVICE 的容器实例具有相同的私有 IP 地址.建议它们托管在附图中的同一主机(标记为容器组)上.不确定这是否是正确的标签抱歉，我是 Container tech 的新手.

感谢您的任何建议.斯科特

解决方案

可能的解决方案

可能有解决办法:

• 创建了一个新的 VNET
• 地址范围 10.60.0.0/23
• 创建子网容器 10.60.0.0/24
• 已创建 VNET 防火墙资源
• 创建子网防火墙 10.60.1.0/24
• 为防火墙资源分配静态公共地址

现在是防火墙规则"允许以下内容:

• NAT 规则 - 典型的端口转换
• 网络规则 - 路由地址
• 应用程序规则 - 路由 FQDN

正在努力将容器部署到这个开发子网，从表面上看，所有选项都在那里，重定向端口、ip 或 FQDN.游戏的变化在于能够将静态公共地址分配给 VNET 内的资源，并允许 NAT、网络或应用程序规则重定向流量.

明天会更新结果.

2019 年 2 月更新

好的，所以不要使用 Azure 防火墙资源.它非常昂贵，就我而言，无论如何都不划算@每月约500英镑.我没有时间使用防火墙测试理论，但由于成本问题，没有任何意义进一步研究.

Azure 容器实例允许使用 IP 地址和完全限定域名 (FQDN) 将容器直接公开到 Internet.创建容器实例时，您可以指定自定义 DNS 名称标签，以便可以在 customlabel.azureregion.azurecontainer.io 访问您的应用程序.遗憾的是，目前 ACI 不支持静态公共 IP 地址.

将容器组部署到虚拟网络时存在某些限制.

• 要将容器组部署到子网，子网不能包含任何其他资源类型.在将容器组部署到现有子网之前，从现有子网中删除所有现有资源，或创建一个新子网.

• 部署到虚拟网络的容器组目前不支持公共 IP 地址或 DNS 名称标签.

• 由于涉及额外的网络资源，将容器组部署到虚拟网络通常比部署标准容器实例要慢一些.

2020 年 3 月更新

由于 20/03/20 引入了以下功能，3 月更新了帖子以供参考:

本文介绍了一种使用 Azure 应用程序网关公开容器组的静态公共 IP 地址的方法.如果您需要在 Azure 容器实例中运行的面向外部的容器化应用的静态入口点，请按照以下步骤操作.

在本文中，您将使用 Azure CLI 为该场景创建资源:

• Azure 虚拟网络
• 部署在虚拟网络(预览版)中的容器组，用于托管小型 Web 应用
• 应用网关具有公共前端 IP 地址，用于托管网站的侦听器网关，以及到后端容器组的路由

只要应用程序网关运行并且容器组公开一个稳定的网络委派子网中的私有 IP 地址，可通过此公共 IP 地址访问容器组.

创建虚拟网络

az group create --name myResourceGroup --location eastus

使用 az network vnet create 命令创建虚拟网络.此命令在网络中创建 myAGSubnet 子网.

az network vnet create --name myVNet --资源组我的资源组--位置东方--地址前缀 10.0.0.0/16 --subnet-name myAGSubnet --子网前缀 10.0.1.0/24

使用 az network vnet subnet create 命令为后端容器组创建子网.这里它被命名为 myACISubnet.

az 网络 vnet 子网创建 --name myACISubnet --资源组我的资源组--vnet 名称 myVNet --地址前缀 10.0.2.0/24

使用 az network public-ip create 命令创建静态公共 IP 资源.在后面的步骤中，这个地址被配置为应用程序网关的前端.

az group create --name myResourceGroup --location eastusaz 网络公共 IP 创建--资源组我的资源组--name myAGPublicIPAddress --分配方法静态--sku 标准

创建容器组

运行以下 az container create 以在您在上一步中配置的虚拟网络中创建容器组.

该组部署在 myACISubnet 子网中，并包含一个名为 appcontainer 的实例，该实例用于拉取 aci-helloworld 映像.如文档中的其他文章所示，此图像打包了一个用 Node.js 编写的小型 Web 应用程序，该应用程序提供静态 HTML 页面.

az 容器创建 --name 应用程序容器--资源组我的资源组--image mcr.microsoft.com/azuredocs/aci-helloworld --vnet myVNet --subnet myACISubnet

成功部署后，将为容器组分配虚拟网络中的专用 IP 地址.例如，运行以下 az container show 命令来检索组的 IP 地址:

az 容器展示 --name appcontainer --resource-group myResourceGroup --query ipAddress.ip --output tsv

输出类似于:10.0.2.4.

为了在后面的步骤中使用，将 IP 地址保存在环境变量中:

ACI_IP=$(az 容器显示--name 应用程序容器--资源组我的资源组--query ipAddress.ip --output tsv)

创建应用网关

按照应用程序网关快速入门中的步骤在虚拟网络中创建应用程序网关.以下 az network application-gateway create 命令使用公共前端 IP 地址和到后端容器组的路由创建网关.有关网关设置的详细信息，请参阅应用程序网关文档.

az network application-gateway create --name myAppGateway --位置东方--资源组我的资源组--容量 2 --sku 标准_v2 --http 设置协议 http --public-ip-address myAGPublicIPAddress --vnet 名称 myVNet --子网我的AG子网--servers "$ACI_IP";

Azure 最多可能需要 15 分钟来创建应用程序网关.

测试公共 IP 地址现在您可以测试对在应用程序网关后面的容器组中运行的 Web 应用程序的访问.

运行 az network public-ip show 命令检索网关的前端公共 IP 地址:

az network public-ip show --资源组我的资源组--name myAGPublicIPAddress --查询[IP地址]--输出tsv

输出是一个公共 IP 地址，类似于:52.142.18.133.

要在成功配置后查看正在运行的 Web 应用程序，请在浏览器中导航到网关的公共 IP 地址.成功访问类似于:

显示在 Azure 容器实例中运行的应用程序的浏览器屏幕截图

参考

Context

Working on a project to deploy a restful API application and seperate TCP service to an Azure Container Instance. The TCP service requires a static Ipv4 address due to legacy reasons.

Question

I am attempting to isolate my options to assign as static public IP address to the TCP service hosted on an Azure Container Instance. What are the options ?

Tested

1. Deployed Azure Application Gateway with a static public IP address. The App Gateway allows backend pool to be directed to an IP or FQDN endpoint. This appears to be operational (see diagram). Altough the options from the backend pool appear to allow HTTP and HTTPS only , not custom ports. Maybe this can be manipulated if the TCP service can listen on 80 and web API on 443. App gateway is Layer 7 resource for HTTP and HTTPS traffic only.

2. Azure Load Balancer. Could only be directed at the VM, Availablity Set or VM Scale Set.

3. Assign static address to the Resource. Not allowed for Container Instances.

4. Traffic Manager. Doesn't appear to be the correct type of resource for this deployment.

See diagram. The Container Instances for API and TCP SERVICE have the same private IP address when I query via a BASH session. Suggested they are hosted on the same host (labled as Container Group) in the attached diagram. Not sure if that is the correct label sorry, I am new to Container tech.

Thank you for any advice. Scott

解决方案

Possible Solution

May have a solution:

• Created a new VNET
• Address range 10.60.0.0/23
• Created subnet Containers 10.60.0.0/24
• Created VNET Firewall resource
• Created subnet Firewall 10.60.1.0/24
• Assigned Static Public Address to Firewall Resource

Now the Firewall "Rules" allow for the following:

• NAT rules - typical port translation
• Network Rules - route addresses
• Application Rules - route FQDN

Working to deploy the container to this dev subnet , on the face of it all the options are there , redirect port, ip or FQDN. The game changes is teh ability to assign a static public address to a resource within the VNET and allow NAT, network or app rules to redirect traffic.

Will update the thread on result tomorrow.

Update Feb 2019

Ok so dont use an Azure Firewall Resource. Its very expensive and in my case not in anyway cost effective @ approx £500 per month. I did not get the time to test the theory using the firewall , but due to the cost there was not any point in following it further.

Azure Container Instances enables exposing containers directly to the internet with an IP address and a fully qualified domain name (FQDN). When you create a container instance, you can specify a custom DNS name label so your application is reachable at customlabel.azureregion.azurecontainer.io. Unfortunately Static Public IP addresses are not supported on ACI at the moment.

Certain limitations apply when you deploy container groups to a virtual network.

• To deploy container groups to a subnet, the subnet cannot contain any other resource types. Remove all existing resources from an existing subnet prior to deploying container groups to it, or create a new subnet.

• Container groups deployed to a virtual network do not currently support public IP addresses or DNS name labels.

• Due to the additional networking resources involved, deploying a container group to a virtual network is typically somewhat slower than deploying a standard container instance.

https://feedback.azure.com/forums/602224-azure-container-instances

Solution Deployed

• Ubuntu VM created using Azure Image
• Static public address assigned to the VM
• Api and Service deployed in docker image to the VM
• Arm template used for deployment , integrated with DevOps build and release
• Cost per month £23.52 (Cores: 2, 3GB ram, 16GB HD)

This was initially the solution but offloading and managing the SSL cert added complexity.

Update March 2019 - New Solution Deployed

If anyone is interested (not many base on the number of times this thread has been viewed) the final solution deployed was this:

• Provision App Service Plan
• Deployed "API" App Service using a Container Instance to host the API on port 443.
• Dynamic address and standard SSL cert deployed to "API" App Service.
• Deployed "Service" App Service using a Container Instance to host the Service port 80.
• Static address and IP based SSL cert deployed to "Service" App Service. This has the effect of fixing the IP address on the service and meeting my "i need a static ip address" condition.
• Costs about £65 a month to host approx.

Worth noting the only reason the cert was deployed was to fix the IP address on the "Service" app service. Its a work around to resolve the lack of support on Azure currently to allow users to apply a static IP address to a container instance.

Update March 2020

Post updated in March for reference due to the introduction of the following feature 20/03/20:

This article shows one way to expose a static, public IP address for a container group by using an Azure application gateway. Follow these steps when you need a static entry point for an external-facing containerized app that runs in Azure Container Instances.

In this article you use the Azure CLI to create the resources for this scenario:

• An Azure virtual network
• A container group deployed in the virtual network (preview) that hosts a small web app
• An application gateway with a public frontend IP address, a listener to host a website on the gateway, and a route to the backend container group

As long as the application gateway runs and the container group exposes a stable private IP address in the network's delegated subnet, the container group is accessible at this public IP address.

Create virtual network

az group create --name myResourceGroup --location eastus

Create a virtual network with the az network vnet create command. This command creates the myAGSubnet subnet in the network.

az network vnet create 
  --name myVNet 
  --resource-group myResourceGroup 
  --location eastus 
  --address-prefix 10.0.0.0/16 
  --subnet-name myAGSubnet 
  --subnet-prefix 10.0.1.0/24

Use the az network vnet subnet create command to create a subnet for the backend container group. Here it's named myACISubnet.

az network vnet subnet create 
  --name myACISubnet 
  --resource-group myResourceGroup 
  --vnet-name myVNet   
  --address-prefix 10.0.2.0/24

Use the az network public-ip create command to create a static public IP resource. In a later step, this address is configured as the front end of the application gateway.

az group create --name myResourceGroup --location eastus

az network public-ip create 
  --resource-group myResourceGroup 
  --name myAGPublicIPAddress 
  --allocation-method Static 
  --sku Standard

Create container group

Run the following az container create to create a container group in the virtual network you configured in the previous step.

The group is deployed in the myACISubnet subnet and contains a single instance named appcontainer that pulls the aci-helloworld image. As shown in other articles in the documentation, this image packages a small web app written in Node.js that serves a static HTML page.

az container create 
  --name appcontainer 
  --resource-group myResourceGroup 
  --image mcr.microsoft.com/azuredocs/aci-helloworld 
  --vnet myVNet 
  --subnet myACISubnet

When successfully deployed, the container group is assigned a private IP address in the virtual network. For example, run the following az container show command to retrieve the group's IP address:

az container show 
  --name appcontainer --resource-group myResourceGroup 
  --query ipAddress.ip --output tsv

Output is similar to: 10.0.2.4.

For use in a later step, save the IP address in an environment variable:

ACI_IP=$(az container show 
  --name appcontainer 
  --resource-group myResourceGroup 
  --query ipAddress.ip --output tsv)

Create application gateway

Create an application gateway in the virtual network, following the steps in the application gateway quickstart. The following az network application-gateway create command creates a gateway with a public frontend IP address and a route to the backend container group. See the Application Gateway documentation for details about the gateway settings.

az network application-gateway create 
  --name myAppGateway 
  --location eastus 
  --resource-group myResourceGroup 
  --capacity 2 
  --sku Standard_v2 
  --http-settings-protocol http 
  --public-ip-address myAGPublicIPAddress 
  --vnet-name myVNet 
  --subnet myAGSubnet 
  --servers "$ACI_IP" 

It can take up to 15 minutes for Azure to create the application gateway.

Test public IP address Now you can test access to the web app running in the container group behind the application gateway.

Run the az network public-ip show command to retrieve the frontend public IP address of the gateway:

az network public-ip show 
--resource-group myresourcegroup 
--name myAGPublicIPAddress 
--query [ipAddress] 
--output tsv

Output is a public IP address, similar to: 52.142.18.133.

To view the running web app when successfully configured, navigate to the gateway's public IP address in your browser. Successful access is similar to:

Browser screenshot showing application running in an Azure container instance

Ref https://docs.microsoft.com/en-us/azure/container-instances/container-instances-application-gateway

Jan 2021

Final edit to document this article from July 2020 in which you can you set up container groups in a virtual network behind an Azure firewall. You configure a user-defined route and NAT and application rules on the firewall. By using this configuration, you set up a single, static IP address for ingress and egress from Azure Container Instances.

https://docs.microsoft.com/en-us/azure/container-instances/container-instances-egress-ip-address

Documents the use of:

• container group
• azure firewall
• reserved public ip
• routing traffic

The down side is the expense of the Azure Firewall resource. That aside the solution works.

这篇关于将静态公共地址分配给 Azure 容器实例部署的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！