Deploying Azure Resources with Private DNS Zones Across Subscriptions via Azure DevOps

In this article, we will guide you through the process of deploying Azure resources with private DNS zones across subscriptions via Azure DevOps. This is an essential skill for any DevOps engineer or IT professional working with Azure, and this guide will help you get started even if you are new to these technologies.

Prerequisites

Before we begin, there are a few things you will need to have in place:

• An Azure account with the necessary permissions to create and manage resources.
• An Azure DevOps account with a project set up.
• Some knowledge of Azure and Azure DevOps.

Creating a Private DNS Zone

The first step in deploying Azure resources with private DNS zones is to create the private DNS zone itself. This can be done using the Azure portal, Azure CLI, or Azure PowerShell.

To create a private DNS zone using the Azure portal, follow these steps:

1. Navigate to the Azure portal (portal.azure.com).
2. Click on the Create a resource button.
3. Search for Private DNS Zone and select the result.
4. Enter the necessary details, such as the name, resource group, and location, and click Create.

Once the private DNS zone has been created, you can start adding records to it. For example, you might add a record for a virtual network, which will allow resources in that network to resolve names within the private DNS zone.

Deploying Resources with Private DNS Zones

Now that you have a private DNS zone, you can start deploying resources to Azure with that zone. This can be done using Azure Resource Manager (ARM) templates, which are JSON files that define the resources to be deployed.

To deploy a resource with a private DNS zone using an ARM template, you will need to include the following properties:

• apiVersion: The version of the Azure Resource Manager API to use.
• type: The resource type, such as Microsoft.Network/privateDnsZones or Microsoft.Network/virtualNetworks.
• name: The name of the resource.
• location: The location of the resource.
• properties: The properties of the resource, such as the DNS zone name or the virtual network address space.

Here is an example of an ARM template that deploys a private DNS zone and a virtual network:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "dnsZoneName": {
            "type": "string",
            "defaultValue": "example.com"
        },
        "vnetName": {
            "type": "string",
            "defaultValue": "example-vnet"
        },
        "vnetAddressSpace": {
            "type": "string",
            "defaultValue": "10.0.0.0/16"
        }
    },
    "variables": {
        "dnsZoneResourceGroup": "dnsZoneRG",
        "vnetResourceGroup": "vnetRG"
    },
    "resources": [
        {
            "type": "Microsoft.Network/privateDnsZones",
            "apiVersion": "2018-09-01",
            "name": "[parameters('dnsZoneName')]",
            "location": "global",
            "properties": {
                "maxNumberOfRecordSets": 10000
            },
            "resourceGroup": "[variables('dnsZoneResourceGroup')]
        },
        {
            "type": "Microsoft.Network/virtualNetworks",
            "apiVersion": "2018-10-01",
            "name": "[parameters('vnetName')]",
            "location": "[resourceGroup().location]",
            "properties": {
                "addressSpace": {
                    "addressPrefixes": [
                        "[parameters('vnetAddressSpace')]"
                    ]
                },
                "dnsServers": [
                    "10.0.0.4"
                ]
            },
            "resourceGroup": "[variables('vnetResourceGroup')]
        }
    ]
}

In this example, the private DNS zone is deployed to the dnsZoneRG resource group, and the virtual network is deployed to the vnetRG resource group. The virtual network is configured to use the private DNS zone for name resolution by specifying the DNS server IP address (10.0.0.4) in the dnsServers property.

Once you have created your ARM template, you can deploy it using Azure DevOps. This can be done using the Azure Resource Group Deployment task, which is available in the Azure Pipelines marketplace.

Deploying Across Subscriptions

If you need to deploy resources with private DNS zones across subscriptions, you can use the Management Groups feature in Azure. This allows you to group subscriptions and apply policies and roles at the management group level.

To deploy resources with private DNS zones across subscriptions using Azure DevOps, you will need to create a service connection for each subscription. This can be done in the Project settings > Service connections section of Azure DevOps.

Once you have created your service connections, you can use them in your Azure Resource Group Deployment task to deploy resources to each subscription. For example, you might have one task to deploy the private DNS zone to one subscription, and another task to deploy the virtual network to a different subscription.

In this article, we have shown you how to deploy Azure resources with private DNS zones across subscriptions using Azure DevOps. This is a powerful technique that can help you streamline your infrastructure deployment and management processes. By using private DNS zones, you can ensure that your resources are using the correct names and IP addresses, and that they are isolated from the public internet.

References