Skip to main content

Azure Private Link for VeloDB Services

This reference lists the Azure regions supported by VeloDB Services and the Private Link Service resource ID published in each region. It also explains how to create a private endpoint, connect it to the published service, and configure private DNS for supported VeloDB hostnames.

For the supported access paths and connection model, see VeloDB Services.

Requirements​

  • The VeloDB hostname and its Azure region. The Private Link service and private endpoint must be in this region.
  • A VNet and subnet from which clients can access the VeloDB service.
  • Permission to create private endpoints, network rules, and Azure Private DNS records.
  • TCP port 443 allowed between clients and the private endpoint.
Azure regionPrivate Link service resource ID
westus3/subscriptions/c24ebfdf-23c3-4c41-950e-d4d2169aa546/resourceGroups/cmp-westus3/providers/Microsoft.Network/privateLinkServices/pls-84g8h6sf
centralindia/subscriptions/c24ebfdf-23c3-4c41-950e-d4d2169aa546/resourceGroups/cmp-centralindia/providers/Microsoft.Network/privateLinkServices/pls-d0srx9cp

Step 1: Create an Azure private endpoint​

  1. In the Azure portal, open Private endpoints and select Create.
  2. Select a resource group and enter a name such as velodb-services.
  3. Select the region for the private endpoint.
  4. On the Resource tab, select the option to connect to an Azure resource by resource ID or alias.
  5. Enter the VeloDB Cloud Private Link service resource ID for your region.
  6. Request a manual connection. Include the VeloDB Cloud organization name and the note Private access to VeloDB Services in the request message.
  7. Select the client VNet and subnet.
  8. Create the endpoint.

Wait until the private endpoint connection status is Approved. Provisioning state: Succeeded only confirms that the endpoint resource was created.

If the connection remains pending, send the following information to VeloDB Support:

  • VeloDB Cloud organization name
  • VeloDB hostname or hostnames that you plan to route through the endpoint
  • Azure subscription ID
  • Region
  • Private endpoint resource ID
  • Private endpoint connection name

After approval, record the private IP address assigned to the endpoint network interface.

Step 2: Configure private DNS​

  1. Create or select an Azure Private DNS zone.

  2. Link the zone to the client VNet.

  3. If the private zone must cover VeloDB hostnames in multiple Azure regions, use this private DNS zone name:

    azure.velodb.cloud

    You can use a narrower zone such as westus3.azure.velodb.cloud if the VNet needs private access in only one region.

warning

A private DNS zone is authoritative for every hostname in its suffix. DNS does not fall back to the public zone when a hostname has no matching private record. If you use azure.velodb.cloud, add records for every VeloDB hostname that clients must resolve, including each warehouse-specific Console hostname. Otherwise, missing hostnames return NXDOMAIN.

  1. Create an A record for each complete VeloDB hostname.
  2. Point the record to the private endpoint's private IP address.

For example, create records for <warehouse-id>-studio.westus3.azure.velodb.cloud when privately accessing a warehouse-specific Console endpoint and apps-api.westus3.azure.velodb.cloud when privately accessing the Metrics API.

If clients use corporate or custom DNS, configure a conditional forwarder to an Azure DNS Private Resolver or another DNS forwarder that can resolve the private zone.

Step 3: Verify the connection​

From a client in the VNet, resolve each hostname that you configured. For example:

nslookup <warehouse-id>-studio.<region>.azure.velodb.cloud
nslookup apps-api.<region>.azure.velodb.cloud

The hostname must resolve to the private IP assigned to the endpoint network interface.

Verify TLS and HTTP routing with the original VeloDB hostname. Use the request documented for the service that you are accessing. For example:

curl -sS \
  -o /dev/null \
  -w 'remote_ip=%{remote_ip} http_code=%{http_code}\n' \
  https://apps-api.<region>.azure.velodb.cloud/

Confirm that the remote address is private, TLS validation succeeds without --insecure, and the server returns an HTTP response. An unauthenticated request can return 401, 403, or a redirect.

Connect from an on-premises network​

  1. Connect the on-premises network to the VNet through ExpressRoute or VPN Gateway.
  2. Ensure that routes and network rules allow TCP 443 access to the private endpoint.
  3. Configure corporate DNS to forward the regional VeloDB Cloud zone to Azure DNS Private Resolver or a DNS forwarder in the VNet.

Troubleshooting​

ProblemChecks
Private Link service cannot be foundConfirm the complete resource ID and corresponding region.
Connection remains pendingAsk VeloDB Support to approve the private endpoint connection.
VeloDB hostname resolves publiclyCheck the private-zone VNet link, record name, and conditional forwarding.
Connection times outCheck connection approval, NSG rules, routes, firewalls, and TCP 443 access.
TLS validation failsUse the original VeloDB hostname, not the private endpoint IP.