This feature is only available for Airflow 3.x Deployments.
Azure Private Link enables private connectivity between your Remote Execution Agents and the Astro orchestration plane without exposing traffic to the public internet. This guide explains how to set up a Private Endpoint in your Azure environment to establish secure communication with Astro.
By default, Remote Execution Agents communicate with the Astro orchestration plane over the public internet. With Azure Private Link, you can route this traffic through a private connection within Azure, which provides enhanced security and can simplify network configurations for organizations with strict security requirements.
The setup involves creating a Private Endpoint in your Azure subscription that connects to Astronomer’s Private Link Service. Once configured, your Remote Execution Agents can communicate with Astro through this private connection.
Before you can create a Private Endpoint, Astronomer must configure the Private Link Service on the Astro side. Contact Astronomer support with the following information:
Astronomer support will provide you with the Private Link Service alias required to create your Private Endpoint.
After receiving the Private Link Service alias from Astronomer Support, create a Private Endpoint in your Azure subscription.
Before starting, collect the following:
Set the following values:
astro-privatelink.Set the following values:
After creating the Private Endpoint, contact Astronomer support to approve your endpoint connection request. You can proceed with the DNS configuration while waiting for approval.
After creating the Private Endpoint, configure DNS so that your Remote Execution Agents resolve the Astro orchestration plane hostname to the Private Endpoint IP address.
external.astronomer.run as the zone name.clxxxxxxxxx.external.astronomer.run, enter clxxxxxxxxx.After Astronomer support approves your endpoint connection, verify that your Remote Execution Agents can communicate with Astro through the Private Endpoint. Validate in the Astro UI that the agents are heartbeating and reporting a Healthy status. You can also verify from within your network using the following instructions.
The response should show the private IP address assigned to your Private Endpoint rather than a public IP address.
The expected response is 404 page not found. If the connection is successful, your Remote Execution Agents will use the Private Endpoint for all communication with the Astro orchestration plane.
Only one Private Link Service is required per Astro cluster. If you have multiple Remote Execution Agents across different VNets, you can either create a Private Endpoint in each VNet (the Private Link Service alias remains unchanged) or use a single Private Endpoint across your network.
If you previously created a private DNS zone, you can associate additional VNets with the same zone rather than creating new zones for each VNet.
After verifying that the Private Endpoint works correctly, you can optionally configure your Remote Execution Agents to only allow traffic through the Private Endpoint. This ensures that all communication with Astro uses the private connection.
To restrict traffic:
This configuration ensures that only traffic coming through the Private Link Service can reach the Deployment.
The Private Link Service requires manual acceptance of endpoint connections. Contact Astronomer support to approve your endpoint connection request.
Verify that your private DNS zone is correctly configured and linked to the VNet where you are testing. Ensure the A record points to the correct Private Endpoint IP address.
Check that your network security group (NSG) rules allow outbound traffic on port 443 from the subnets where your Remote Execution Agents are running to the Private Endpoint.