Deploy app service with private endpoint enabled via Azure DevOps
Published Apr 16 2023 10:47 PM 16.8K Views
Microsoft

There is a common scenario that customers want their app service being allocated inside private network and cannot be accessed by public network. Therefore, they usually enable private endpoint as well as configure Access Restriction to deny all the public traffic.

 

When the private endpoint is enabled and public traffic is denied to the web app, all the public traffic to this app is cut off. Since there is a range of IP addresses where agents are deployed, they have a public IP. Obviously, these agents are unable to reach web app.

Emma_Yen_0-1680790152527.png

 

As a solution, we can either allow the IP ranges list in the firewall or use self-hosted agents to deploy.

You may check below document for more information Microsoft-hosted-agents for Azure Pipelines

 

In below lab, we will demo 2 tests. One is what if we deploy code to a web app with private endpoint by Microsoft-agent and another one is how to deploy by a self-hosted agent.

 

Lab

Test1: deploy using Microsoft-hosted agent

Result: We will see Error: Failed to deploy web package to App Service. Ip Forbidden (CODE: 403) since web app is not accessible via internet.

 

Create a new pipeline

Emma_Yen_1-1680790152529.png

 

Here, I select GitHub in this demo

Emma_Yen_2-1680790152531.png

 

Deploy a Django app. So I choose the second one.

Emma_Yen_3-1680790152533.png

 

Select subscription and web app name

Emma_Yen_4-1680790152535.png

 

Save and run

Emma_Yen_5-1680790152536.png

 

Web app is private endpoint enabled which means the inbound traffic needs to be a private IP from the same subnet as web app or an IP that has permission to access this app service.

However, Microsoft-agent works over public network. It is deployed failed and the Error - Failed to deploy web package to App Service. Ip Forbidden (CODE: 403)

Emma_Yen_6-1680790152538.png

Emma_Yen_7-1680790152542.png

 

Test2: deploy using self-hosted agent on Linux VM (Ubuntu 20.04)

Result: it works fine. Deploy successfully.

 

Create Linux VM (Ubuntu 20.04) in the same VNET as web app.

Emma_Yen_8-1680790152547.png

In Azure Devops portal, Add agent pool

Emma_Yen_9-1680790152549.png

Emma_Yen_10-1680790152551.png

 

Then New Agent and choose operating system of your build machine. (Here, I choose Linux)

Emma_Yen_11-1680790152553.png

 

Get Personal Access Tokens

 

Emma_Yen_12-1680790152555.png

 

New token and grant permission to agent pools

Emma_Yen_13-1680790152559.png

 

Remember to record this token as it will not displayed again.

Emma_Yen_14-1680790152562.png

 

SSH into Linux VM and configure agent to connect Azure pipeline

Download and create agent

Emma_Yen_15-1680790152564.png

 

Configure agent settings

Sever URL:

  • Emma_Yen_16-1680790152566.png

Please refer to Deploy an Azure Pipelines agent on Linux - Azure Pipelines | Microsoft Learn

Emma_Yen_17-1680790152568.png

 

Run agent

Emma_Yen_18-1680790152570.png

 

Check from portal that agent is online

Emma_Yen_19-1680790152573.png

 

In order to get confused, we create a separated pipeline here.

Creation Steps are the same as previous steps: 

New Pipeline -> GitHub -> Python to Linux Web App on Azure -> Select subscription -> Select web app name -> Save and run

 

Modify the yml file. Change pool to the one just created.

Emma_Yen_20-1680790152576.png

 

Then, run the pipeline again. We can see that it deployed successfully this time.

Emma_Yen_21-1680790152578.png

 

References

Deploy an Azure Pipelines agent on Linux - Azure Pipelines | Microsoft Learn

Microsoft-hosted-agents for Azure Pipelines

1 Comment
Co-Authors
Version history
Last update:
‎Apr 16 2023 10:14 PM
Updated by: