Egress Private Link Endpoints Setup Guide: First-Party Services on Azure for Confluent Cloud

This topic presents the steps for setting up Egress Private Link Endpoints for the Azure first-party services on Azure and Confluent Cloud to enable the use of fully managed connectors in Confluent Cloud using Azure Private Link.

Step 1. Create a gateway in Confluent Cloud (for Enterprise cluster only)

If using an Enterprise cluster in Confluent Cloud, you must set up a gateway in Confluent Cloud as described in Create a gateway for outbound connectivity in Confluent Cloud.

Step 2. Retrieve the Resource ID

1. In the Azure portal, go to your service’s overview section, and click Json View.

   

2. Copy the Resource ID which is required when you create the Egress Private Link Endpoint in Confluent Cloud.

   

Step 3. Create an Egress Private Link Endpoint

1. In the Network Management tab of the desired Confluent Cloud environment, click the Confluent Cloud network you want to add the Private Link Endpoint to. The Connection Type of the network needs to be “Private Link Access”.

2. Click Create endpoint in the Egress connections tab.

3. Click the service you want to connect to. Select Other if you do not see the specific service.

4. Follow the guided steps to specify the field values, including:

   • Name: The name of the Private Link Endpoint.

   • Resource ID: The resource ID of the Private Link service.

     The Resource ID is the one noted down above, in the last step of the Step 2 section.

     Note that the resource alias is not supported.

   • Sub-resource name: The sub-resource name for the specific Azure service.

     The applicable sub-resource name can be retrieved in Azure Private-link resource.

     For example:

     Target System	Sub-resource Name
     Blob	blob
     Data Lake Storage Gen2	dfs
     Cosmos DB (Dependent on type)	Sql, MongoDB, Cassandra, Gremlin, Table

5. Click Create to create the Private Link Endpoint.

6. If there are additional steps for the specific target service, follow the prompt to complete the tasks, and then click Finish.

Step 4. Accept the connection request

When the Private Link Endpoint status becomes “Pending Accept” in the Azure portal, go to Pending Connections and approve the associated connection request.

Confirm this is the correct connection by checking the Description column which will provide the associated Confluent Cloud gateway and environment ID.

Step 5. Create the DNS record

1. When the Private Link Endpoint status transitions to “Ready”, in the Egress DNS tab, click Create DNS record, or click Create Record on the associated Private Link Endpoint tile.
2. Specify the following:
   • Egress Private Link Endpoint: The Egress Private Link Endpoint ID you created in create an Egress Private Link Endpoint.
   • Domain: The associated service endpoint. For example, for Azure SQL Server, it is in the pattern, <sql-server-name>.database.windows.net. For multiple domains, for example, with Cosmo DB, you can specify a comma-separated list of the domain values. Get the domain values from Azure.
3. Click Save.

Step 6. Create the Connector

1. When the DNS Record status transitions to “Ready”, you can create the connector.
2. For the steps to create the connector, refer to the connector-specific documentation that is listed for your specific connector in Supported connectors.