Route Traffic to Azure Container Apps

Santhya Rama S

If you have Azure Container Apps (ACA) deployed within an internal Virtual Network (VNet), Azure automatically provisions an Internal Load Balancer (ILB) to manage traffic. However, traffic may not be correctly routed from the ILB to the container apps without additional configuration.

This guide explains the best and easiest approach to correctly route traffic using User-Defined Routes (UDR) and other essential settings without requiring an Application Gateway.

Step-by-Step Solution :

1. Ensure Internal Ingress is Enabled for ACA

Before configuring routing, verify that your ACA ingress settings are correctly configured:

• Set ingress type to "internal" to restrict ACA to internal traffic.
• Define the required ports and protocols (e.g., HTTP, TCP).

For more details, refer to the Azure ACA Ingress Documentation.

2. Configure the Internal Load Balancer (ILB)

Azure automatically creates an ILB when ACA is deployed in an internal VNet. However, it might not be configured to route traffic correctly.

• Identify the ILB IP address assigned to ACA.
• Ensure that ACA is part of the ILB backend pool.

For additional details, check Azure Container Apps Networking.

3. Implement User-Defined Routes (UDR) for Traffic Routing

Since Azure does not automatically create system routes for ILB traffic to ACA, you need to define custom routes using User-Defined Routes (UDR).

Steps to Create a UDR:

1. Navigate to Azure Portal > Networking > Route Tables.
2. Create a new Route Table and associate it with the subnet where your ACA resides.
3. Add a new route:
   • Destination: CIDR block of your ACA environment (e.g., 10.0.0.0/24).
     • Next Hop Type: Select Virtual Appliance.
       • Next Hop Address: Set this to the ILB private IP address.
       1. Save the route and apply it to the VNet subnet hosting ACA.

This ensures that internal traffic correctly reaches the ACA services.

For detailed steps, refer to the official User-Defined Routes for ACA documentation.

4. Validate and Troubleshoot Traffic Flow

To ensure proper traffic routing:

• Use Azure Monitor and Log Analytics to check traffic logs.
• Test connectivity using Azure Bastion or a VM inside the VNet (curl ).
• Verify that NSGs and Firewall Rules allow internal communication.
• Check DNS settings to resolve internal ACA endpoints correctly.

Conclusion :

By following this approach, you can successfully route traffic from Azure ILB to your ACA environment inside an internal VNet without needing an Application Gateway.

This method ensures secure, reliable, and efficient traffic flow using UDRs, ILB backend configurations, and private networking settings.