Azure Mongo vcore private endpoint not created, or not working as expected

It seems you are experiencing issues with the configuration of private endpoints for your Azure Mongo vCore setup. Here are some steps to troubleshoot the connectivity and DNS resolution issues you are facing:

1. Verify Private Endpoint Configuration: Ensure that your private endpoint is correctly configured and that the connection state is Approved. You can do this by checking the Private Link Center in the Azure portal.
2. DNS Configuration: Since you mentioned that you suspect the SRV DNS record is not working, confirm that the private DNS zone is properly integrated with your virtual network. You can check the DNS configuration on the private endpoint to ensure that the Private DNS zone is linked to the virtual network.
3. Private DNS Zone Entries: Make sure that the necessary DNS records are created in your private DNS zone. You should have entries for the FQDNs that correspond to your private endpoint. If they are missing, you may need to recreate the private endpoint with DNS integration enabled.
4. Testing DNS Resolution: Use the nslookup command on a VM within the same virtual network to check if the FQDN resolves to the correct private IP address assigned to the private endpoint. This will help you confirm whether DNS resolution is functioning as expected.
5. Check Azure Monitor: Utilize Azure Monitor to check if data is flowing through the private endpoint. This can help you identify if the issue is related to connectivity or DNS resolution.
6. Review Terraform Configuration: Ensure that your Terraform configuration is correctly set up to create the private endpoint and DNS records. Double-check the parameters related to private DNS zone integration in your Terraform scripts.

If you follow these steps and still face issues, consider reaching out to Azure support for more detailed assistance specific to your configuration.

Hi Nedeljko Scepanovic,
Your MongoDB vCore private endpoint creates the connection but misses DNS records because the private_dns_zone_group needs a zone_name = "mongocluster" parameter, and subresource_names must be lowercase ["mongocluster"] (not "MongoCluster").

Fixed Terraform Code:

text
resource "azurerm_private_endpoint" "mongo" {
  name                = "pe-mongo-vcore-${var.client}-${var.env}"
  location            = azurerm_resourcegroup.rg.location
  resource_group_name = azurerm_resourcegroup.rg.name
  subnet_id           = azurerm_subnet.private_endpoints.id

  private_service_connection {
    name                           = "mongo-connection-${var.client}-${var.env}"
    private_connection_resource_id = azurerm_mongo_cluster.mongo_vcore.id
    subresource_names              = ["mongocluster"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "mongo-dns"
    private_dns_zone_ids = [azurerm_private_dns_zone.mongo.id]
    zone_name            = "mongocluster"  # This creates the SRV/A records
  }
}

DNS Zone:
Your privatelink.mongo.cosmos.azure.com zone is correct. After terraform apply, expect these auto-created records:

fc-ad4xxxxxcac0-000.mongocluster → 10.x.x.5

fc-ad4xxxxxcac0-000.global → 10.x.x.5

fc-ad4xxxxxcac0-000.ro.global → 10.x.x.5

Test Connection

From VNet VM:

bash
nslookup fc-ad4xxxxxcac0-000.mongocluster.privatelink.mongo.cosmos.azure.com
# Should return 10.x.x.5

mongo "mongodb+srv://adminTerraform:******@mongo-vcore-xxx.privatelink.mongo.cosmos.azure.com/?tls=true"

Hope this helps! Let me know if there’s more info you can share so I can assist you further.

@Pilladi Padma Sai Manisha

Thank you for your kind reply,

I see there is some mistake in your reply.

I managed to get proper terraform configuration with TF ARM provider, but still without SRV record, not sure is it possible to get it anyway.

In my provider's ver. which is 4.56.0 is not supporting option zone_name in PE configuration.

Also in my TF configuration I realized it was not correct private zone.
How I managed to fix issue ?

Just reverse engineering.

I have created Mongo vCore instance with terrafrom and added private endpoint via Azure Portal.

I guess, from AKS/Azure VNET we need to use mongodb://, and from outside we can use also srv record. As AKS will behind private endpoint, and it is not planned Mongo access to be public, I guess we will not use srv record anyway.

@Pilladi Padma Sai Manisha please verify my answer. I guess here is problem with not updated documentations. For example in Azure private dns list I wasn't able to find dns zone
privatelink.mongocluster.cosmos.azure.com.

resource "azurerm_mongo_cluster" "mongo_vcore" {
  name                   = "mongo-vcore-${var.client}-${var.env}"
  resource_group_name    = azurerm_resource_group.rg.name
  location               = azurerm_resource_group.rg.location
  administrator_username = "adxxxxxxorm"
  administrator_password = "QAzzzzzdfg"
  shard_count            = "1"
  compute_tier           = "M20"
  high_availability_mode = "Disabled"
  storage_size_in_gb     = "32"
  version =  "7.0"
}

resource "azurerm_private_dns_zone" "mongo" {
  name                = "privatelink.mongocluster.cosmos.azure.com"
  resource_group_name = azurerm_resource_group.rg.name
}


resource "azurerm_private_dns_zone_virtual_network_link" "mongo" {
  name                  = "mongo-vnet-link-${var.client}-${var.env}"
  resource_group_name   = azurerm_resource_group.rg.name
  private_dns_zone_name = azurerm_private_dns_zone.mongo.name
  virtual_network_id    = azurerm_virtual_network.vnet.id
}


resource "azurerm_private_endpoint" "mongo" {
  name                = "pe-mongo-vcore-${var.client}-${var.env}"
  location            = azurerm_resource_group.rg.location
  resource_group_name = azurerm_resource_group.rg.name
  subnet_id           = azurerm_subnet.private_endpoints.id

  private_service_connection {
    name                           = "mongo-connection-${var.client}-${var.env}"
    private_connection_resource_id = azurerm_mongo_cluster.mongo_vcore.id
    subresource_names              = ["MongoCluster"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "mongo-dns"
    private_dns_zone_ids = [azurerm_private_dns_zone.mongo.id]
  }
}

Hello @Pilladi Padma Sai Manisha , I would to ask you for more assistance. Code what I wrote in my peronal laptop, and used in my personal Azure is working fine with public accessible AKS. But when I tried to implement same code in work azure account, I got same behavior as with Azure verified module for Mongo vCore. Just Mongo is not working, I am able to resolve privatelink dns record, but not able to connect on Mongo db.

Difference between my own env is:

• work related AKS is private, behind private endpoint and also using overlay network for pods
• My AKS in my private Azure, is public accessible, it is NOT behind private endpoint, and is using Azure CNI for VNET.

Please assist, I have tried to many things, and I am lost. Strange, just I am scared this is because outdated documentation, and I had this issues in past, just I am blind :(.
Ned.

I had chat with my Lead, and I guess everything was working fine, but I used wrong connection string.

As per documentation Private link doesn't support SRV record, and I ddin't try to use it. I guess azure documentation is not up to date, I don't have other idea how I managed to miss this. Anyway on the end this is solution if someone has problems in future. I used terraform vcore resources and also with Azure provided module.
This is working connection string:

mongodb+srv://asomeuser:******@mongo-vcore.global.mongocluster.cosmos.azure.com/?tls=true&authMechanism=SCRAM-SHA-256&retrywrites=false&maxIdleTimeMS=120000