azure - why Extra subnet for VNET integration for app services

Question

Why do we have to create a new subnet or add the app service to an empty subnet in our vnet? I don't understand the reasoning since I'm trying to use my app service (function app) as a reverse proxy to access the resources in the vnet.

question from:https://stackoverflow.com/questions/66058440/why-extra-subnet-for-vnet-integration-for-app-services

Answer 1

By default, the Azure function is a PaaS as the other Azure Platform-as-a-Services that have inbound and outbound traffic over the Internet. We can host our applications without the need to worry about the maintenance of the servers and their operating systems.

To use Azure Functions to connect to resources in an Azure virtual network, we can use the VNet integration feature. To use this feature, we need to create a subnet in the virtual network for your function app to use. VNet Integration must be configured to use an empty subnet. It doesn't matter that your functions use a different subnet than your VM. The virtual network automatically routes traffic between the two subnets. Read Connect your function app to the virtual network

The extra empty subnet is used to hosting your app instance. To let the app instance outbound traffic work like from a VNet, Azure mounts NICs with assigned private IP addresses in that subnet. With VNet integration, your function app is connected to both the internet and your virtual network.

For more information, you may read How regional VNet Integration works and How gateway-required VNet Integration works