Project: YugabyteDB (App Definition and Development / Database)
File: managed-endpoint-azure.md

title: Connect VPCs using Azure Private Link headerTitle: Set up private link linkTitle: Set up private link description: Connect to a VNet in Azure using Private Link. headcontent: Connect your endpoints using Private Link menu: preview_yugabyte-cloud: identifier: managed-endpoint-1-azure parent: cloud-add-endpoint weight: 50 type: docs <ul class="nav nav-tabs-alt nav-tabs-yb"> <li> <a href="../managed-endpoint-aws/" class="nav-link"> <i class="fa-brands fa-aws" aria-hidden="true"></i> AWS </a> </li> <li> <a href="../managed-endpoint-azure/" class="nav-link active"> <i class="fa-brands fa-microsoft" aria-hidden="true"></i> Azure </a> </li> </ul> Connect your cluster to an application VPC via Azure Private Link. To use Azure Private Link, you need the following: An Azure user account with an active subscription. The subscription ID of the service to which to grant access to the cluster endpoint. To find your subscription, follow the instructions in . Make sure that default security group in your application Azure Virtual Network (VNet) allows internal connectivity. Otherwise, your application may not be able to reach the endpoint. To use Azure Private Link to connect your cluster to an Azure VNet that hosts your application, first create a private service endpoint (PSE) on your cluster, then create a corresponding private endpoint in Azure. You create the PSEs (one for each region) for your cluster on the cluster Settings tab, or using . To create or edit a PSE, do the following: Select your cluster. Navigate to Settings > Network Access > Private Service Endpoint. Click Create Private Service Endpoint or, to edit an existing PSE, Edit Private Service Endpoint to display the Edit Private Service Endpoint sheet. For each region in your cluster, provide an Azure Subscription ID you want to grant access. Click Save. The endpoints are displayed with the following values: Host - The host name of the PSE. You will use this to . The host name of a PSE for Azure always ends in `azure.ybdb.io`. Service Name - The Service Name is also referred to as an alias in Azure. You will use this name when creating the private endpoint in Azure. To create a PSE, do the following: Enter the following command: ```sh ybm cluster network endpoint create \ --cluster-name <yugabytedb_cluster> \ --region <cluster_region> \ --accessibility-type PRIVATESERVICEENDPOINT \ --security-principals <azuresubscriptionids> ``` Replace values as follows: `yugabytedb_cluster` - name of your cluster. `cluster_region` - cluster region where you want to place the PSE. Must match one of the regions where your cluster is deployed (for example, `westus3`), and preferably match the region where your application is deployed. `azuresubscriptionids` - comma-separated list of the subscription IDs of Azure subscriptions that you want to grant access. Note the endpoint ID in the response. You can also display the PSE endpoint ID by entering the following command: ```sh ybm cluster network endpoint list --cluster-name <yugabytedb_cluster> ``` This outputs the IDs of all the cluster endpoints. After the endpoint becomes ACTIVE, display the service name of the PSE by entering the following command: ```sh ybm cluster network endpoint describe --cluster-name <yugabytedbcluster> --endpoint-id <endpointid> ``` Note the following values: Host - The host name of the PSE. You will use this to . The host name of a PSE for Azure always ends in `azure.ybdb.io`. Service Name - The Service Name is also referred to as an alias in Azure. You will use this service name when creating the private endpoint in Azure. To delete a PSE, enter the following command: ```sh ybm cluster network endpoint delete \ --cluster-name <yugabytedb_cluster> \ --endpoint-id <endpoint_id> \ ``` You can create the private endpoint using the or from the command line using the

To create a private endpoint to connect to your cluster PSE, do the following: In the , under the Azure services heading, select Private endpoints. If you don't see Private endpoints, use the search box to find it. On the Private endpoints page, click + Create to display the Create a private endpoint wizard. On the Basics page, provide the following details: Subscription - select your subscription. Resource group - select the resource group in which the private endpoint was created. Name - enter a name for the endpoint. Network interface name - enter a network interface name for the endpoint. Region - select the region for the endpoint. This should be the same region where your application resides. Click Next: Resource and set the following values: Connection method - select Connect to an Azure resource by resource ID or alias. Resource ID or alias - enter the Service Name (noted when you ) of the PSE you created for your cluster. Click Next: Virtual Network and set the following values: Select the Azure virtual network and subnet where your application resides. Click Next: DNS, Next: Tags, and Next Review + create >. You don't need to provide any values on the DNS page; Tags are optional. Review the details and click Create to create the private endpoint. The endpoint will take a minute or two to deploy. When complete, the Connection State will be Approved. To verify the status of the endpoint, navigate to Private endpoints under the Azure services heading. Note the Private IP address of the endpoint for use in the following steps. To be able to connect to your cluster using DNS (rather than the bare IP address), you must create a private DNS zone in the same resource group, link the private DNS zone to the VNet containing the private endpoint, and add an A record pointing to the private IP address of the private endpoint. To create a private DNS zone: In the , under the Azure services heading, select Private DNS zones. On the Private DNS zones page, click + Create to display the Create Private DNS zone wizard. Provide the following details: Subscription - select your subscription. Resource group - select the resource group in which the private endpoint was created. Instance details - enter a DNS zone name of `azure.ybdb.io`. Click Next: Tags, and Next Review create >. Review the details and click Create to create the private DNS zone. The DNS zone will take a minute or two to deploy. To view the private DNS zone, navigate to Private DNS zones under the Azure services heading. Navigate to Private DNS zones under the Azure services heading and select the azure.ybdb.io private DNS zone you created. Under Settings, select Virtual network links and click + Add. On the Add virtual network link page, provide the following details: Link name - enter a name for the link. Subscription - select your subscription. Virtual network - select the virtual network where you created the private endpoint. Click OK. The link is listed in the Virtual network links list. Navigate to Private DNS zones under the Azure services heading and select the azure.ybdb.io private DNS zone you created. Select Overview and click + Record set. Under Add record set, set the following values: Name - enter the first part only of the Host name of the cluster PSE (noted when you ). This consists of the text before .azure.ybdb.io. For example, for the host ```sh pse-westus3.65f14618-f86a-41c2-a8c6-7004edbb965a.azure.ybdb.io ``` you would enter only ```sh

``` The PSE Host is also displayed in YugabyteDB Managed under Connection Parameters on the cluster Settings > Infrastructure tab. Type - select the A - Address record option (this is the default). IP address - enter the private IP address of your Azure private endpoint (noted earlier). Click OK. You can now connect to your cluster from your application in Azure using your cluster PSE host address (for example, `pse-westus3.65f14618-f86a-41c2-a8c6-7004edbb965a.azure.ybdb.io`). To create the private endpoint and connect it to your YBM PSE (called a private link service in Azure) using the , enter the following command: ```sh az network private-endpoint create \ --connection-name <privatelinkserviceconnectionname> \ --name <privateendpointname> \ --private-connection-resource-id <pseservicename> \ --resource-group <resourcegroupname> \ --subnet <subnet_name> \ --vnet-name <privateendpointvnet_name> \ -location <privateendpointregion_name> ``` Replace values as follows: `privatelinkserviceconnectionname` - provide a name for the private link connection from the private endpoint to the private link service. `privateendpointname` - provide a name for the private endpoint. `pseservicename` - the Service Name of the PSE, which you noted down when creating the PSE. `resourcegroupname` - the resource group in which the private endpoint will be created. `subnet_name` - the name of the subnet in the resource group in which the private endpoint will be created. `privateendpointvnet_name` - the name of the VNet where the private endpoint will be created. `privateendpointregion_name` - the Azure region in which the private endpoint and VNet are present. To be able to connect to your cluster using DNS (rather than the bare IP address), create a private DNS zone in the same resource group, link the private DNS zone to the VNet containing the private endpoint, and add an A record pointing to the private IP address of the private endpoint. To create a private DNS zone, enter the following command: ```sh az network private-dns zone create \ --name azure.ybdb.io \ --resource-group <resourcegroupname> ``` Replace values as follows: `resourcegroupname` - the resource group in which the private endpoint was created. All private DNS zones for endpoints that are used with YugabyteDB Managed are named `azure.ybdb.io`. To link the private DNS zone to the VNet containing the private endpoint, enter the following command: ```sh az network private-dns link vnet create --name <privatednszone_name> --registration-enabled true --resource-group <resourcegroupname> --virtual-network <privateendpointvnet_name> --zone-name azure.ybdb.io --tags yugabyte ``` Replace values as follows: `privatednszone_name` - provide a name for the private DNS zone. `resourcegroupname` - the resource group in which the private endpoint was created. `privateendpointvnet_name` - the name of VNet in which the private endpoint was created. To obtain the Network Interface (NIC) resource ID for the private endpoint, enter the following command: ```sh az network private-endpoint show \ --name <privateendpointname> \ --resource-group <resourcegroupname> ``` Replace values as follows: `privateendpointname` - the name of the private endpoint. `resourcegroupname` - the resource group in which the private endpoint was created. This command returns the NIC resource ID of the private endpoint (`privateendpointnicresourceid` in the following command). To obtain the ipv4 address of the private endpoint, enter the following command: ```sh az network nic show \ --ids <privateendpointnicresourceid> \ --query "ipConfigurations[0].privateIPAddress" ``` This command returns the ipv4 address of the private endpoint (`privateendpointipv4_address` in the following command). To create an A record in the private DNS zone, enter the following command: ```sh az network private-dns record-set a add-record \ --ipv4-address <privateendpointipv4_address> \ --record-set-name <recordsetname> \ --resource-group <resourcegroupname> \ --zone-name azure.ybdb.io ``` Replace values as follows: `privateendpointipv4_address` - the IP address of the private endpoint. `recordsetname` - provide a name for the record. `resourcegroupname` - the resource group in which the private endpoint was created.