how to peer vnet with synapse managed vent

Akhilesh Pachipulusu 5

We have a VNet on which AKS is running, we want to peer this VNet with Synapse Managed VNet so that we can connect to the api hosted in the aks vnet from spark cluster

Rehan Razzaque Rajput 0 Reputation points

2024-06-03T13:43:16.6+00:00
Hi Akhilesh,

Not sure if you need it anymore, but just putting the reference here if someone else might need this. While you cannot directly bring synapse within your own network, you CAN bring AKS services to synapse and reach them from your notebooks.

I followed this article and tried to reach a service deployed on our private AKS cluster, and it worked.

https://alexisplantin.fr/aks-and-pls/#aks-and-private-link-service-integration

Basically, you would need to add the following annotations to your K8s Service:

service.beta.kubernetes.io/azure-load-balancer-internal: "true" service.beta.kubernetes.io/azure-pls-create: "true" service.beta.kubernetes.io/azure-pls-name: my-service-pls

This will automatically create a private link service in the managed resource group of your kubernetes cluster. Then:

Go to Synapse Workspace

Go to Manage view.

Go to Security => Managed private endpoints.

Click New.

Select Private link service.

Then you can select the private link service (e.g., my-service-pls)

Create this private endpoint.

Approve the private endpoint on the azure portal page of my-service-pls.

Now, your synapse workers can talk directly to the service exposed on Kubernetes.

1 answer

JimmySalian-2011 42,066 Reputation points

2023-03-21T07:11:15.3733333+00:00

Hi Akhilesh,

For this the managed VNET integration has to be done via the Synapse Workspace check this -https://video2.skills-academy.com/en-us/azure/synapse-analytics/security/synapse-workspace-managed-vnet

So some of the points to take care is private endpoints and outbound traffic to approved targets.

Hope this helps.

JS

==

Please Accept the answer if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Akhilesh Pachipulusu 5 Reputation points

2023-03-21T11:28:28.2433333+00:00

I want to allow inbound traffic coming from synapse network in my VNet

BhargavaGunnam-MSFT 28,526 Reputation points Microsoft Employee

2023-03-24T16:41:11.42+00:00

Hello Akhilesh Pachipulusu,

To allow inbound traffic from the Synapse Managed VNet to your AKS VNet, you can configure a network security group in your AKS VNet and then associate the NSG with the subnet that you want to allow inbound traffic.

I hope this helps. Please let us know if you have any further questions.

Akhilesh Pachipulusu 5 Reputation points

2023-03-27T05:32:08.25+00:00

I already have a NSG, what configuration will required in the inbound rule, because we don't get the Synapse VNet details or the IP ranges of spark pools

BhargavaGunnam-MSFT 28,526 Reputation points Microsoft Employee

2023-03-29T02:40:57.07+00:00

If you already have an NSG in place, you need to configure an inbound security rule that allows traffic from the Synapse Managed Virtual Network without specifying a specific IP address range. You can use the "Service Tag" option in the NSG rule settings to do this.

Follow these steps to create an inbound rule that allows traffic from the Synapse Managed Virtual Network:

Go to the "Inbound security rules" section of the NSG in question.

Click "Add" to create a new inbound rule.

In the "Basics" section of the rule settings, give the rule a name and select the appropriate priority for the rule.

In the "Source" section, select "Service Tag" and then select "AzureSynapseAnalytics". This option will allow traffic from any Synapse Managed Virtual Network IP address to enter your VNet.

In the "Destination" section, select the appropriate port range for the traffic you want to allow.

In the "Action" section, select "Allow"

Optionally, you can add a description for the rule in the "Description" section.

Once you have created this rule, traffic from the Synapse Managed Virtual Network should be able to enter your VNet through the specified port range.

Paul Delcogliano 0 Reputation points

2023-03-29T12:40:15.4133333+00:00

hi Bhargava, I am trying to do the same as Akhilesh. I followed the instructions you provided above. However, when I select "Service Tag" from the drop down, I don't see an option for "AzureSynapseAnalytics". Is there another option I should choose?

BhargavaGunnam-MSFT 28,526 Reputation points Microsoft Employee

2023-03-30T23:39:05.6966667+00:00

Paul Delcogliano,

Thanks for pointing this out. It could be the synapse analytics service tag may not be available in all Azure regions. In this case, configure an inbound security rule that allows traffic from the Synapse Managed Virtual Network by specifying the IP address range.

Rehan Razzaque Rajput 0 Reputation points

2024-06-03T11:25:22.69+00:00

BhargavaGunnam-MSFT,

Are you sure those service tags really exist? Because I cannot find the documentation on them anywhere - nor see them on the portal.

https://video2.skills-academy.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags
Sign in to comment

Share via

how to peer vnet with synapse managed vent

1 answer