So I have integrated my application gateway with azure container apps.
I have the following ports exposed in my container app:
- 8080
- 5000
- 9000
I have the following nsg rule:
<code>security_rule {
name = "AllowInboundFromAGW"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "*" #[80, 443, 8080, 9000, 5000]
source_address_prefixes = var.public-subnet.address_prefixes
destination_address_prefixes = var.private-subnet.address_prefixes
}
</code>
<code>security_rule {
name = "AllowInboundFromAGW"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "*" #[80, 443, 8080, 9000, 5000]
source_address_prefixes = var.public-subnet.address_prefixes
destination_address_prefixes = var.private-subnet.address_prefixes
}
</code>
security_rule {
name = "AllowInboundFromAGW"
priority = 100
direction = "Inbound"
access = "Allow"
protocol = "Tcp"
source_port_range = "*"
destination_port_range = "*" #[80, 443, 8080, 9000, 5000]
source_address_prefixes = var.public-subnet.address_prefixes
destination_address_prefixes = var.private-subnet.address_prefixes
}
The following NSG rule is relatively permissive, thus i want to limit the access to the specific ports that agw use to talk with the container app.
I tried opening only the ports mentioned above in the destination port range, but it disconnects the services and the health prope is failing. I figured that a lot of magic is going on in Azure container apps (I did create the exact same setup in ACI without any issues), so obviously some additional ports are used which to me doesn’t seem apparent in the documentation.