Private DNS Resolver in Hub-Spoke VNET

[gerrynicol]

AB#35135

Describe the feature end to end, including deployment scenario details under which the feature would occur.

Maybe not a feature request but more a question around ALZ design. It appears the documentation for the Azure private DNS resolver has changed and the recommendation is now to have this hosted in a seperate spoke VNET with the Private DNS Zones linked to this rather than the Hub vNET. (This seems to be due to potential issues with having it hosted in the same VNET as an express route gateway). The ALZ deployment still has the vNET links to the Azure Private DNS zones to the Hub vNET. Just looking for thoughts on the differences here and also thoughts on what Subscription that shared services spoke vNET should sit? The Connectivity Subscription?

Why is this feature important. Describe why this would be important for your organization and others. Would this impact similar orgs in the same way?

To match with the Azure Private DNS Resolver documentation. https://learn.microsoft.com/en-us/azure/architecture/networking/architecture/azure-dns-private-resolver

Please provide the correlation id associated with your error or bug.

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Can you describe any alternatives that you have taken since this feature does not exist?

N\A

Feature Implementation

N\A

Check previous GitHub issues

• I have searched the issues for this item and found no duplicate

Code of Conduct

• I agree to follow this project's Code of Conduct

[oZakari]

Hi @gerrynicol, great question! We just recently updated the CAF documentation with the incorporation of Private DNS Resolver here. As there are some differences to what you found in the Architecture Center I will try to see if I can get some additional insight to provide to you on the differences.

There is currently an active upstream work item (AB#17026), which is currently being used to determine how we want to incorporate DNS Resolver and the updated guidance into all of our reference implementations, including ALZ-Bicep as well.

Therefore, it may be some time before it actually gets incorporated here just as a heads up.

[oZakari]

Hey @gerrynicol, just an update, we are currently working with the individual who created the Architecture Center documentation you referenced to better understand the scenario they are accounting for in their guidance and will work on aligning them or adding a disclaimer if need be.

[gerrynicol]

Thanks @oZakari

[jtracey93]

Hey folks im going to move this upstream to the ALZ repo as it applies to all implementations 👍