Skip to main content

Configure private connectivity to the per-warehouse Console endpoint on Azure

This guide explains how to use Azure Private Link to access the per-warehouse Console endpoint privately from your Azure VNet, without traversing the public internet.

For an overview of the connection model and its requirements, see Private connectivity to the per-warehouse Console endpoint.

Requirements​

  • The console hostname and its Azure region.
  • A VNet and subnet that can be reached by users of the per-warehouse Console tools.
  • Permission to create private endpoints, network rules, and Azure Private DNS records.
  • TCP port 443 allowed between clients and the private endpoint.
Azure regionPrivate Link service resource ID
westus3/subscriptions/c24ebfdf-23c3-4c41-950e-d4d2169aa546/resourceGroups/cmp-westus3/providers/Microsoft.Network/privateLinkServices/pls-84g8h6sf
centralindia/subscriptions/c24ebfdf-23c3-4c41-950e-d4d2169aa546/resourceGroups/cmp-centralindia/providers/Microsoft.Network/privateLinkServices/pls-d0srx9cp

Step 1: Create an Azure private endpoint​

  1. In the Azure portal, open Private endpoints and select Create.
  2. Select a resource group and enter a name such as velodb-studio.
  3. Select the region for the private endpoint.
  4. On the Resource tab, select the option to connect to an Azure resource by resource ID or alias.
  5. Enter the VeloDB Cloud Private Link service resource ID for your region.
  6. Request a manual connection. Include the VeloDB Cloud organization name and the note VeloDB per-warehouse Console endpoint private access in the request message.
  7. Select the client VNet and subnet.
  8. Create the endpoint.

Wait until the private endpoint connection status is Approved. Provisioning state: Succeeded only confirms that the endpoint resource was created.

If the connection remains pending, send the following information to VeloDB Support:

  • VeloDB Cloud organization name
  • Console hostname
  • Azure subscription ID
  • Region
  • Private endpoint resource ID
  • Private endpoint connection name

After approval, record the private IP address assigned to the endpoint network interface.

Step 2: Configure private DNS​

  1. Create or select an Azure Private DNS zone.

  2. Link the zone to the client VNet.

  3. Use the most specific practical zone name. For example:

    westus3.azure.velodb.cloud

  4. Create an A record for the complete console hostname.

  5. Point the record to the private endpoint's private IP address.

The private DNS zone is authoritative for the entire regional suffix inside its linked VNets. With the configuration in this guide, DNS queries do not fall back to the public zone when a hostname under that suffix has no matching private record. Add an A record for every per-warehouse Console hostname in the region that clients need to resolve. Otherwise, hostnames for other warehouses in the same region can return NXDOMAIN.

If clients use corporate or custom DNS, configure a conditional forwarder to an Azure DNS Private Resolver or another DNS forwarder that can resolve the private zone.

Step 3: Verify the connection​

From a client in the VNet, run:

nslookup <warehouse-id>-studio.<region>.azure.velodb.cloud

The hostname must resolve to the private IP assigned to the endpoint network interface.

Verify TLS and HTTP routing:

curl -sS \
  -o /dev/null \
  -w 'remote_ip=%{remote_ip} http_code=%{http_code}\n' \
  https://<warehouse-id>-studio.<region>.azure.velodb.cloud/webui_api/api/data/catalogs

Confirm that the remote address is private, TLS validation succeeds without --insecure, and the server returns an HTTP response. An unauthenticated request can return 401, 403, or a redirect.

Finally, open the warehouse in the VeloDB Console from an authenticated browser and use one of the covered tools, such as running a query in SQL Editor.

Connect from an on-premises network​

  1. Connect the on-premises network to the VNet through ExpressRoute or VPN Gateway.
  2. Ensure that routes and network rules allow TCP 443 access to the private endpoint.
  3. Configure corporate DNS to forward the regional VeloDB Cloud zone to Azure DNS Private Resolver or a DNS forwarder in the VNet.

Troubleshooting​

ProblemChecks
Private Link service cannot be foundConfirm the complete resource ID and corresponding region.
Connection remains pendingAsk VeloDB Support to approve the private endpoint connection.
Console hostname resolves publiclyCheck the private-zone VNet link, record name, and conditional forwarding.
Connection times outCheck connection approval, NSG rules, routes, firewalls, and TCP 443 access.
TLS validation failsUse the original console hostname, not the private endpoint IP.