Hello all!

We're rolling out a fix that changes how client IPs are resolved in Private Link-enabled Container Apps environments that use IP ingress restrictions.

TL;DR

Until now, if you had Private Link enabled, your app was seeing our internal proxy's IP instead of the real client IP. This meant IP restriction rules were matching against proxy IPs, and many of you had to add infra subnet ranges to your allowlists as a workaround.

We've fixed this — your app will now see the actual client IP.

This also means X-Forwarded-For will now correctly show the real client IP.

Action needed before we deploy

If you're using Private Link + IP restrictions, make sure your real client IPs are in the allowlist before this rolls out. Otherwise, traffic that used to get through (via the proxy IP match) will start getting blocked.

Here's what to do:

• Add your actual client IPs to the allowlist
• Keep the infra subnet ranges if you already have them — no need to remove, they won't cause issues
• Test access after updating

What does this affect?

Only environments where all three of these are true:

1. Private Link is enabled
2. IP restrictions are configured
3. The allowlist has infra subnet ranges but not real client IPs

Post-Change Actions

• After the change has been rolled out, we will notify via the comments, and you can remove the old gateway addresses since they will lose their purpose.

Docs

• IP ingress restrictions
• Ingress overview

Drop a comment if you have questions!