Configure an Azure Dedicated Cloud Gateway with VNET peering and private hosted zones

Uses: Konnect Platform

Incompatible with

on-prem

Prerequisites

Kong Konnect

This tutorial requires a Konnect Plus account. If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.

Microsoft Entra

To approve the Dedicated Cloud Gateway app, you need a Microsoft Entra admin account with the Application Administrator role.

Copy your Entra tenant ID from your dashboard.

Microsoft Azure CLI

Install the Azure CLI and authenticate:

az login

Copied!

Azure virtual network

To configure VNET peering in Konnect, you’ll need a virtual network configured in Azure.

Copy and export the following:

export VNET_SUBSCRIPTION_ID='YOUR VNET SUBSCRIPTION ID'
export RESOURCE_GROUP_NAME='RESOURCE GROUP NAME FOR YOUR VNET'
export RESOURCE_GROUP_ID='RESOURCE GROUP ID FOR YOUR VNET'
export VNET_NAME='YOUR VNET NAME'

Copied!

Important: Your Azure virtual network must use a different IP than your network in Konnect, which is 10.0.0.0/16 by default but can be edited.

Azure private DNS zone

Configuring Azure private hosted zones for Dedicated Cloud Gateways involves creating a private DNS zone in Azure, linking the private DNS zone to your virtual network, and configuring a private hosted zone in Konnect.

Create a private DNS zone in Azure in the same resource group as the virtual network that you’re using for VNET peering.
Copy and save your domain name, private DNS zone name, private DNS subscription ID, and private DNS resource group name.

When you deploy Dedicated Cloud Gateway in Konnect, Konnect hosts the data plane nodes on Azure. Then, you can use Azure virtual network peering to establish a secure, low-latency connection between your Azure environment and the Konnect platform.

flowchart LR

A(API or service)
B(API or service)
C(API or service)

G(fa:fa-konglogo-gradient-secondary Konnect <br>#40;fully-managed <br>data plane#41;)
H(fa:fa-konglogo-gradient-secondary Konnect <br>#40;fully-managed <br>data plane#41;)
J(Internet)

subgraph 1 [User Azure Cloud]
      subgraph 3 [Virtual Network #40;VNET#41;]
      A
      B
      C
      end
end
3 <--VNET Peering <br> Private API Access--> 6

subgraph 4 [Kong Azure Cloud]
      subgraph 6 [Virtual Network #40;VNET#41;]
      G
      H
      end
end

G & H <--public API <br> access--> J

Create an Azure Dedicated Cloud Gateway

First, configure a Dedicated Cloud Gateway with an Azure network.

In the Konnect sidebar, click API Gateway.
From the New dropdown menu, select “New API gateway”.
Select Dedicated Cloud.
In the Gateway name field, enter Azure.
Click Create and configure.
From the Provider dropdown menu, select “Azure”.
From the Region dropdown menu, select the region you want to configure the cluster in.
Edit the Network range as needed.

Important: Your Azure virtual network must use a different IP than your network in Konnect, which is 10.0.0.0/16 by default but can be edited.
From the Access dropdown menu, select “Public” or “Private”.
Click Create data plane node.

Important: Wait until your Azure network displays as Ready before proceeding to the next step.

Configure VNET peering in Konnect

Now that your Dedicated Cloud Gateway Azure network is ready, you can configure VNET peering to connect your Azure virtual network to your Dedicated Cloud Gateway.

In the Konnect sidebar, click API Gateway.
Click your Azure Dedicated Cloud Gateway.
Click the Networks tab.
From the action menu next to your Azure network, select “Configure private networking”.
Click Virtual network peering.
In the Tenant ID field, enter your Microsoft Entra tenant ID.
In the Subscription ID field, enter your virtual network’s subscription ID.
In the Resource group name field, enter your virtual network’s resource group name.
In the VNET Name field, enter your virtual network’s name.
Click Next.
Grant access to the Dedicated Cloud Gateway app in Microsoft Entra using the link provided in the setup wizard.

Important: You need an admin account to approve the app.
Create a peering role with the Azure CLI using the command in the UI wizard.

Konnect requires permission to create and manage peering resources. You must define a role named Kong Cloud Gateway Peering Creator with the following permissions:
- Read and write access to Virtual Network peering configurations
- Permission to perform peering actions
Assign the role to the service principal so it has permission to peer with your virtual network using the command in the UI wizard.
Select Please confirm if you have completed the above mentioned steps.
Click Done.

Configure private hosted zones for your Azure network in Konnect

After your Azure private networking configuration is ready in Konnect, you can configure private hosted zones.

In the Konnect sidebar, click API Gateway.
Click your Azure Dedicated Cloud Gateway.
Click the Networks tab.
From the action menu next to your Azure network, select “Configure private DNS”.
Click Private hosted zone.
In the Name field, enter the fully qualified domain name for your private hosted zone in Azure.
In the Tenant ID field, enter your tenant ID from Microsoft Entra.
In the Subscription ID field, enter the subscription ID for your private DNS zone.
In the Resource group name field, enter the resource group name that your private DNS zone is in.
In the Virtual network link name field, enter a unique name for the virtual network link.

Your virtual network link name must be unique and cannot match an existing virtual network link name. When you configure private DNS for a Dedicated Cloud Gateway, Konnect automatically creates a virtual network link in Azure using the name you specify here.
In the Private DNS zone name field, enter the name of your private DNS zone in Azure.
Create a DNS link creator role with the Azure CLI using the command in the UI wizard.
Assign the role to the service principal with the Azure CLI using the command in the UI wizard.
Link your private DNS zone to your virtual network using the command provided by the private DNS wizard in the UI.
Select I confirm that I completed all required steps and understand that incorrect configuration can cause DNS resolution issues.
Click Connect.

Validate

After your private hosted zone configuration displays as ready, you can begin using your Dedicated Cloud Gateway. To verify that it’s ready, do the following:

In the Konnect sidebar, click API Gateway.
Click your Azure Dedicated Cloud Gateway.
Click the Networks tab.
From the action menu next to your Azure network, select “Configure private DNS”.
Scroll until you see Ready for private DNS.

FAQs

When I try to create the VNET peering role and assign the role to the service principal, I get the following errors: (RoleDefinitionWithSameNameExists) A custom role with the same name already exists in this directory. and Role 'Kong Cloud Gateway Peering Creator - Kong' doesn't exist.. How do I fix this?

This error can occur because you have multiple subscriptions in the same Entra tenant and the Azure CLI can’t assign another subscription to the role. To resolve this in Azure, search for the role and manually add additional subscription IDs to it instead of using the CLI.