You are configuring an Azure Container Apps environment with a custom Virtual Network. Your AI containers need to securely connect to an Azure SQL Database that is secured behind a private endpoint. Which configuration is required on the Container Apps environment?
Trap 1: Use an external Azure Application Gateway in front of the container…
While Application Gateway handles inbound traffic, it does not resolve outbound private endpoint routing for the app environment.
Trap 2: Enable Azure Bastion on the subnet
Azure Bastion is used for interactive administrative RDP/SSH access to VMs, not container routing.
Trap 3: Configure IP restriction rules on the ingress controller
Ingress rules control incoming traffic, not outbound traffic to internal private endpoints.
- A
Use an external Azure Application Gateway in front of the container apps
Why it fails: While Application Gateway handles inbound traffic, it does not resolve outbound private endpoint routing for the app environment.
- B
Deploy the Container Apps environment into a custom VNet with workload profile subnets
Deploying the environment into a custom VNet with workload profile subnets gives containers VNet-integrated outbound connectivity, allowing private endpoint resolution to the Azure SQL Database. Without VNet injection, traffic egresses publicly and the private endpoint is unreachable.
- C
Enable Azure Bastion on the subnet
Why it fails: Azure Bastion is used for interactive administrative RDP/SSH access to VMs, not container routing.
- D
Configure IP restriction rules on the ingress controller
Why it fails: Ingress rules control incoming traffic, not outbound traffic to internal private endpoints.