<a id="cloud-networking-peering-azure"></a>

<a id="cloud-networking-azure"></a>

# Use Azure VNet Peering with Confluent Cloud

Azure Virtual Network (VNet) peering connects an Azure VNet to Confluent Cloud so the
two route traffic between each other using private IPv4 addresses, as if they
are on the same network.

For more information about VNet peering with Azure, see [Virtual Network Peering](https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview).

[Managed connectors](../../connectors/overview.md#kafka-connect-cloud) created in a VNet-peered cluster
can access data sources and sinks hosted in all peered VNets, if the firewall
rules allow connector traffic to and from the peered VNets.

## Requirements and considerations

* A [Confluent Cloud network](../overview.md#ccloud-network-overview) of the “VNet
  Peering” type and the “Microsoft Azure” provider.

  If a network does not exist, see [Create Confluent Cloud Network on Azure](../ccloud-network/azure.md#create-ccloud-network-azure).
* If the peered VNet’s address space contains any addresses outside of RFC 1918
  (`10/8`, `172.16/12`, or `192.168/16` prefixes) or RFC 6598
  (`100.64/10` prefix)  CIDR ranges, the routes to these addresses will be
  rejected.
* Transitive VNet peering is not supported. If you peer Network A to
  Network B, and peer Network B to Confluent Cloud, applications running in
  Network A will not be able to access Confluent Cloud.

  Confluent Cloud does not support the following features that Azure provides to achieve
  transitive peering, namely:
  * Azure Gateway Transit
  * User Defined Routes (UDRs)
* You can colocate multiple Confluent Cloud Dedicated clusters in the same Confluent Cloud
  network, but this is limited by the expected number and size of these
  clusters. The applicable limits are specified in [Network Quotas](../../quotas/service-quotas.md#ccloud-resource-limits-network).
* Cross-region peering is not supported through the Confluent Cloud Console. Contact
  Confluent Support to see if your regions are supported and to request
  configuration.

<a id="cloud-networking-peering-azure-connection"></a>

## Create a VNet peering connection

A peering connection needs to be created in order to access Confluent Cloud
clusters and services in a Confluent Cloud network using VNet peering.

The high level workflow to create a VNet peering connection is:

1. [Grant access to Microsoft Entra ID Tenant](#azure-peering-grant-access).

   If you are using the Confluent Cloud Console to configure peering, this step can be
   skipped and performed in the Grant Access stage in the third step below,
   [Create a VNet peering connection in Confluent Cloud](#azure-peering-create-connection).
2. [Add a tag in Azure](#azure-peering-add-tag).

   If you are using the Confluent Cloud Console to configure peering, this step can be
   skipped and performed in the Grant Access stage in the third step below,
   [Create a VNet peering connection in Confluent Cloud](#azure-peering-create-connection).
3. [Create a VNet peering connection in Confluent Cloud](#azure-peering-create-connection).

You need to gather the following information from the [Microsoft Azure portal](https://portal.azure.com):

* Azure Tenant ID: Your organization ID in Microsoft Entra ID.

  You can find this value on the [Entra ID Overview](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview)
  page.
* Azure Subscription ID: The identifier for your Azure subscription.

  You can find this on the [Overview section of your Virtual network](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks).
* Azure VNet resource group name: The identifier for the Azure resource group
  that the virtual network belongs to.

  You can find this on the [Overview section of your Virtual network](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks).
* Azure VNet Name: The name of your Azure virtual network.

  You can find this on the [Overview section of your Virtual network](https://portal.azure.com/#blade/HubsExtension/BrowseResource/resourceType/Microsoft.Network%2FvirtualNetworks).

<a id="azure-peering-grant-access"></a>

### Grant access to Microsoft Entra ID Tenant

Grant access to your Microsoft Entra ID Tenant before you can create a
peering connection.

1. Go to the following URL using your Microsoft Entra ID Tenant ID (`<tenant-id>`)
   and click **Accept** to approve the peering connection:
   ```text
   https://login.microsoftonline.com/<tenant-id>/oauth2/authorize?client_id=f0955e3a-9013-4cf4-a1ea-21587621c9cc&response_type=code
   ```

   The `client_id` in the URL is the Confluent Cloud application client ID in Azure.
2. Using an Azure command line tool, such as [Azure Cloud Shell](https://portal.azure.com/#cloudshell/), run the following
   command to create a new role.

   If you have more than one subscription ID, update the `AssignableScopes`
   accordingly.
   ```text
   az role definition create --output none --role-definition '{
      "Name": "Confluent Cloud Peering Creator",
      "Description": "Perform cross-tenant network peering.",
      "Actions": [
          "Microsoft.Network/virtualNetworks/read",
          "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
          "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
          "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
          "Microsoft.Network/virtualNetworks/peer/action"
      ],
      "AssignableScopes": [
          "subscriptions/<subscription-id>",
      ]
   }'
   ```
3. Using an Azure command line tool, run the following command with your
   subscription ID (`<subscription-id>`), VNet resource group name
   (`<resource-group-name>`), and VNet name (`<vnet-name>`) to assign the
   role to the service principal:
   ```text
   az role assignment create `
     --role "Confluent Cloud Peering Creator" `
     --assignee "$(az ad sp list --filter "appId eq 'f0955e3a-9013-4cf4-a1ea-21587621c9cc'" `
     --output tsv --query '[0].id')"  `
     --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>"
   ```

   #### NOTE
   Starting with Azure CLI v. 2.37.0, the `objectId` property in the
   output JSON of a Graph object is replaced by `id`. If you use an
   earlier version, use `objectId` in the `--output` line.

<a id="azure-peering-add-tag"></a>

### Add a tag in Azure

In your Microsoft Entra ID tenant, add a tag to the VNet you want to peer with
Confluent Cloud network.

For the complete steps, see  [Apply tags with Azure portal](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources-portal).

1. In the Azure portal, navigate to the VNet you want to peer with Confluent Cloud
   network.
2. Click **Tags**.
3. Specify the tag key and the value:
   * **Name**: `ConfluentEnvIDs`.
   * **Value**: The Confluent Cloud environment ID where the Confluent Cloud
     networks you’d like your VNet to be peered with reside.

   To peer your VNet with multiple Confluent Cloud networks that belong to different
   Confluent Cloud environments, specify a comma-separated list of the environment IDs.
   For example:
   ```text
   ConfluentEnvIDs: <CCloud-env-id-1>, <CCloud-env-id-2>
   ```
4. Click **Apply**.

<a id="azure-peering-create-connection"></a>

### Create a VNet peering connection in Confluent Cloud

Follow the steps to create an Azure VNet network peering connection.

You can have multiple VNet peering connections. For information about limits,
see [Kafka cluster quotas](../../quotas/service-quotas.md#ccloud-resource-limits-kafka-cluster).

### Confluent Cloud Console

1. In the **Network Management** tab of the desired Confluent Cloud environment,
   click the **For dedicated cluster** tab.
2. Click the Confluent Cloud network to which you want to add the peering connection.
3. In the **Ingress connections** tab, click **+VNet Peering**.
4. Specify the following field values in the Configure VNet Peering phase.
   * **Azure Tenant ID**: Your organization in Microsoft Entra ID.
   * **Azure Subscription ID**: The Azure subscription ID.
   * **Azure VNet resource group name**: The resource group ID that the
     VNet belongs to.
   * **Azure VNet Name**: The name of your Azure Virtual network.
5. Click **Add**.
6. Grant access to your Microsoft Entra ID Tenant in the Grant Access stage.
   1. Go to the given URL and click **Accept** to approve the peering
      connection.

      The URL is pre-populated with your Tenant ID you provided in the
      previous Configure VNet Peering phase, and the `client_id` is the
      Confluent Cloud application client ID in Azure.
   2. Using an Azure command line tool, such as [Azure Cloud Shell](https://portal.azure.com/#cloudshell/), run the following
      command to create a new role.

      The command is pre-populated with the information you provided in
      the previous Configure VNet Peering phase, namely, your subscription
      ID (`<subscription-id>`).

      You might have to update the command shown on the page with the
      latest command syntax as shown below.

      If you have more than one subscription ID, update the
      `AssignableScopes`.
      ```text
      az role definition create --output none --role-definition '{
      "Name": "Confluent Cloud Peering Creator",
      "Description": "Perform cross-tenant network peering.",
      "Actions": [
          "Microsoft.Network/virtualNetworks/read",
          "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/read",
          "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/write",
          "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/delete",
          "Microsoft.Network/virtualNetworks/peer/action"
      ],
      "AssignableScopes": [
          "/subscriptions/<subscription-id>/",
      ]
      }'
      ```
   3. Run this command to assign the role to the service principal.

      The command is pre-populated with the information you provided in
      the previous Configure VNet Peering phase, namely, your subscription
      ID (`<subscription-id>`), VNet resource group name
      (`<resource-group-name>`), and VNet Name  (`<vnet-name>`). = You
      might have to update the command shown on the page with the latest
      command syntax as shown below.
      ```text
      az role assignment create `
        --role "Confluent Cloud Peering Creator" `
        --assignee "$(az ad sp list --filter "appId eq 'f0955e3a-9013-4cf4-a1ea-21587621c9cc'" `
        --output tsv --query '[0].id')"  `
        --scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>"
      ```
   4. [Add a tag in Azure](#azure-peering-add-tag).
   5. Click **Continue**. You are prompted to confirm that Confluent Cloud is present
      in your Microsoft Entra ID Tenant.
   6. Click **Create connection** to finish creating the peering connection.

### Confluent REST API

1. [Grant access to Microsoft Entra ID Tenant](#azure-peering-grant-access).
2. [Add a tag in Azure](#azure-peering-add-tag).
3. Create a VNet peering connection.

   Now that you granted access to the Microsoft Entra ID Tenant, you can
   create the VNet peering connection using an HTTP request that resembles the following REST API example:

   **HTTP POST request**
   ```text
   POST https://api.confluent.cloud/networking/v1/peerings
   ```

   **Authentication**

   See [Authentication](https://docs.confluent.io/cloud/current/api.html/#authentication).

   **Request specification**
   ```json
   {
      "spec":{
         "cloud":{
            "kind":"AzurePeering",
            "tenant":"<Microsoft Entra ID Tenant ID in which you are peering with Confluent Cloud>",
            "vnet":"/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>",
            "customer_region":"<VNet region>"
         },
         "display_name":"<connection name>",
         "environment":{
            "id":"<Confluent Cloud environment id>"
         },
         "network":{
            "id":"<Confluent Cloud network id>"
         }
      }
   }
   ```

### Confluent CLI

1. [Grant access to Microsoft Entra ID Tenant](#azure-peering-grant-access).
2. [Add a tag in Azure](#azure-peering-add-tag).
3. Use the [confluent network peering create](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html)
   Confluent CLI command to create a peering connection:
   ```bash
   confluent network peering create azure-peering <flags>
   ```

   The following command-specific flags are supported:
   * `--network`: Required. Confluent Cloud network ID.
   * `--cloud`: Required. The cloud provider. Set to `azure`.
   * `--cloud-account`: Required. Azure Tenant ID in which your Azure
     Subscription exists and you are peering with Confluent Cloud.
   * `--virtual-network`: Required. The value should be in the following pattern:
     ```text
     /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Network/virtualNetworks/<vnet-name>
     ```
   * `--customer-region` Cloud region ID of the Azure VNet that you are
     peering with Confluent Cloud network.

   You can specify additional optional CLI flags described in the [Confluent
   CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
   such as `--environment`.

   The following is an example Confluent CLI command to create a VNet
   peering:
   ```bash
   confluent network peering create azure-peering \
     --network n-123456 \
     --cloud azure \
     --cloud-account 1111tttt-1111-1111-1111-111111tttttt \
     --virtual-network /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.Network/virtualNetworks/my-vnet \
     --customer-region centralus
   ```

### Terraform

As a prerequisite, Terraform Provider for Confluent should be installed
and has access to a Confluent Cloud administrator account.

Confluent provides a [Terraform configuration](https://github.com/confluentinc/terraform-provider-confluent/tree/master/examples/configurations/dedicated-vnet-peering-azure-kafka-acls)
for creating a VNet peering connection. This configuration automates the
manual steps described below.

1. [Grant access to Microsoft Entra ID Tenant](#azure-peering-grant-access).
2. [Add a tag in Azure](#azure-peering-add-tag).
3. Use the `confluent_peering` resource to create a peering connection.

   To create a peering connection with Terraform Provider for Confluent use the following snippet of Terraform configuration:
   ```terraform
   # Configure the Confluent Provider
   terraform {
     required_providers {
       confluent = {
         source  = "confluentinc/confluent"
       }
     }
   }
   provider "confluent" {
     cloud_api_key    = var.confluent_cloud_api_key    # optionally use CONFLUENT_CLOUD_API_KEY env var
     cloud_api_secret = var.confluent_cloud_api_secret # optionally use CONFLUENT_CLOUD_API_SECRET env var
   }
   ...
   resource "confluent_peering" "azure" {
     display_name = "Azure Peering"
     azure {
       tenant          = "1111tttt-1111-1111-1111-111111tttttt"
       vnet            = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/my-rg/providers/Microsoft.Network/virtualNetworks/my-vnet"
       customer_region = "centralus"
     }
     environment {
       id = confluent_environment.development.id
     }
     network {
       id = confluent_network.azure-peering.id
     }

     lifecycle {
       prevent_destroy = true
     }
   }
   # Create more resources ...
   ```

   You must provide appropriate Confluent Cloud credentials to use
   the provider.

   For the full `confluent_peering` resource reference, see the
   [Confluent Terraform Provider documentation](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_peering)
   in the Terraform registry.

<br/>

When you are finished, the peering status should display “Ready” in the
Confluent Cloud Console.

<a id="dns-resolution-azure-peering"></a>

## DNS resolution

Confluent Cloud hosts and manages the DNS records for endpoints which use Azure VNet peering connectivity. In order for your Kafka clients to resolve these DNS names, they must be able to resolve records from public DNS servers.

Confluent does not provide a supported private DNS solution for the clusters that use Azure VNet peering.

<a id="dns-forwarding-azure-peering"></a>

## Configure DNS forwarding

To resolve hostnames that reside within private DNS zones or a self-hosted DNS
server and access your own VNet or on-prem from Confluent Cloud, set up DNS forwarding
in Confluent Cloud.

For example, you can use DNS forwarding for Confluent Cloud fully managed connectors
that need to access data in your VNet.

The DNS Forwarder requires VNet peering where there is
bi-directional network access between your network and Confluent Cloud clusters.

### Step 1: Get DNS resolver IP addresses

To use the DNS forwarding feature with your Azure VNet, you can set up Azure
Inbound Endpoints or use your own DNS server:

Create an inbound endpoint for a private DNS zone.

* If you wish to forward DNS requests from Confluent Cloud to a private DNS zone,
  create Inbound Endpoints for Confluent Cloud network to access your DNS servers.

  Azure recommends deploying multiple endpoints in different availability zones.

  Inbound Endpoints should allow TCP/UDP connections on port 53.

  For details, see [Configuring inbound endpoints](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets#inbound-endpoints).

  Once the endpoints are created, input the IP addresses of the Inbound
  Endpoints to which to forward requests as described in the [next step](#dns-forwarding-ccloud-az).
* If you want to use your self-hosted DNS server, use the IP address of that DNS
  server in Confluent Cloud in the [next step](#dns-forwarding-ccloud-az).

<a id="dns-forwarding-ccloud-az"></a>

### Step 2: Create a DNS Forwarder in Confluent Cloud

Set up DNS forwarding in Confluent Cloud.

### Confluent Cloud Console

1. In Confluent Cloud, navigate to the **DNS Forwarding** tab in the
   **Network Detail** page.
2. Input the following information:
   * **DNS server IPs:** One or more IP addresses of you DNS servers
     to which we should forward DNS request.
   * **Domain list:** One or more domains to which you wish to route
     the DNS requests.
3. Wait until provisioning is complete and DNS is propagated.

### Confluent REST API

Send a request to create a DNS Forwarder resource:

**REST request**

```rest
POST https://api.confluent.cloud/networking/v1/dns-forwarders
```

**REST request body**

```json
{
  "spec":
  {
    "display_name": "<The Custom name for the DNS Resolver>",
    "environment":
    {
      "id": "<The Environment ID where the DNS Resolver belongs to>"
    },
    "config":
    {
      "kind": "ForwardViaIp",
      "dns_server_ips": "<A list of IP address(es), up to 3, of DNS server(s) from your VNet>"
    },
    "domains": "<A list of domains, up to 10, for the DNS forwarder to use>",
    "gateway":
    {
      "id": "<The gateway ID to which this belongs>",
      "environment": "<Environment of the referred resource, if env-scoped>"
    }
  }
}
```

To get the gateway id, issue the following API request:

```rest
GET https://api.confluent.cloud/networking/v1/networks/{Confluent Cloud network ID}
```

You can find the gateway id in the response under `spec.gateway.id`.

### Confluent CLI

Use the [confluent network dns forwarder create](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html)
Confluent CLI command to set up a DNS forwarder:

```bash
confluent network dns forwarder create <dns-forwarder-name> <flags>
```

The following command-specific flags are supported:

* `--dns-server-ip`: Required. A comma-separated list of IP addresses
  for the DNS server.
* `--gateway`: Required. Gateway ID. To get the gateway id, run the
  following CLI command:
  ```bash
  confluent network describe
  ```
* `--domains`: A comma-separated list of domains for the DNS forwarder
  to use.

You can specify additional optional CLI flags described in the
[Confluent CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment` and `--output`.

The following is an example Confluent CLI command to create a DNS
forwarder:

```bash
confluent network dns forwarder create \
  --domains abc.com,def.com \
  --dns-server-ips 10.200.0.0,10.201.0.0 \
  --gateway gw-123456
```

The following is an example Confluent CLI command to create a named DNS
forwarder:

```bash
confluent network dns forwarder create my-dns-forwarder \
  --domains abc.com,def.com \
  --dns-server-ips 10.200.0.0,10.201.0.0 \
  --gateway gw-123456
```

### Terraform

Use the [confluent_dns_forwarder](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_dns_forwarder)
Confluent Terraform Provider resource to set up a DNS forwarder.

An example snippet of Terraform configuration:

```terraform
resource "confluent_environment" "development" {
  display_name = "Development"
}

resource "confluent_dns_forwarder" "main" {
  display_name = "dns_forwarder"
  environment {
    id = confluent_environment.development.id
  }
  domains = ["example.com", "domainname.com"]
  gateway {
    id = confluent_network.main.gateway[0].id
  }
  forward_via_ip {
    dns_server_ips = ["10.200.0.0", "10.200.0.1"]
  }
}
```