Why does a VM still resolve a storage account publicly after a private endpoint was added?

0 reputation · 11 May 2024, 17:04 UTC

125.9K views2

A storage private endpoint and its DNS record exist. A VM in a connected network still resolves the ordinary blob hostname to a public address. The VM uses a custom DNS server, while another VM using the intended Azure resolver gets a private address. The application configuration has not changed. Which part of the DNS chain should be investigated?

Environment

Editorial worked example. See the question for the scenario and assumptions.

Keep exploring this topic

Should an application use the privatelink Blob hostname to force private connectivity?

In a worked migration scenario, an engineer changes the blob endpoint in application settings from the normal account hostname to the privatelink form. The aim is to guarantee private traffic, but connectivity becomes inconsistent between environments. What hostname should remain in the application, and what evidence actually proves the private route?

/etc/resolv.conf symlink behavior when transitioning from systemd-resolved

Analysis of the transition from systemd-resolved symlinks to static DNS configuration in Debian to avoid resolution failures.

Network-scripts deprecation in Rocky Linux 9 affecting ifcfg persistence

Exploring the behavior of NetworkManager in Rocky Linux 9 when handling legacy ifcfg files and the role of NetworkManager in synchronizing ifcfg configurations.

Vaadin Flow silent WebSocket to Long Polling fallback

Investigate why and why Vaadin Flow might silently transition from WebSocket to long polling and how to debug the underlying handshake failures.

Start with the custom resolver path. A private zone and VNet link do not make every custom DNS server consult that zone automatically. Compare the queried resolver, forwarding rules and the network where Azure private-zone resolution happens. Check the applicable private-zone link and record as well.

Keep the ordinary storage hostname in the application. Do not replace it with an IP or a privatelink hostname. After repairing the forwarding path, repeat the lookup from the failing VM and then perform an authorized blob operation with the runtime identity. The example is solved when both private resolution and service access are demonstrated.

Why does a VM still resolve a storage account publicly after a private endpoint was added?

2 answers

Your perspective belongs here.

0 question comments