This guide explains how to give the Cloudmersive Private Cloud Virus Scan API a stable, public DNS name after you have installed the Helm chart on Azure Kubernetes Service (AKS).

All commands below can be run from Azure Cloud Shell, which has az, kubectl, and helm pre-installed. They also work from any workstation with the Azure CLI and kubectl installed.

How it works

The Helm chart creates a Kubernetes Service of type LoadBalancer named cloudmersive-privatecloud-virusscanapi. On AKS, this causes Azure to provision a public IP address on the cluster's load balancer.

Azure can attach a DNS label to that public IP. When you do, Azure automatically publishes an FQDN in the form:

<your-label>.<azure-region>.cloudapp.azure.com

You control this by adding a single annotation to the Service. No changes to the Helm chart or to the Cloudmersive container are required.

Prerequisites

• The Helm chart is installed and the pod is running.
• You know your AKS resource group and cluster name.
• Your account has permission to run kubectl against the cluster (Azure Kubernetes Service Cluster User role or equivalent).

Step 1: Connect to the cluster

az aks get-credentials --resource-group <resource-group> --name <cluster-name>

Confirm the Cloudmersive Service exists and has been assigned a public IP:

kubectl get service cloudmersive-privatecloud-virusscanapi

Example output:

NAME                                     TYPE           CLUSTER-IP    EXTERNAL-IP     PORT(S)        AGE
cloudmersive-privatecloud-virusscanapi   LoadBalancer   10.0.143.12   20.51.102.233   80:31245/TCP   5m

If EXTERNAL-IP shows <pending>, wait a minute and run the command again. Azure can take one to two minutes to provision the load balancer.

Step 2: Choose a DNS label

Pick a label that is unique within your Azure region. Labels must be lowercase, 3 to 63 characters, and may contain letters, numbers, and hyphens. They must start with a letter and end with a letter or number.

Example: contoso-virusscan

Step 3: Apply the DNS label to the Service

kubectl annotate service cloudmersive-privatecloud-virusscanapi \
  service.beta.kubernetes.io/azure-dns-label-name=<your-label> \
  --overwrite

Replace <your-label> with the label you chose in Step 2. For example:

kubectl annotate service cloudmersive-privatecloud-virusscanapi \
  service.beta.kubernetes.io/azure-dns-label-name=contoso-virusscan \
  --overwrite

The AKS cloud controller detects the annotation and applies the DNS label to the public IP. This usually completes within a minute.

Step 4: Confirm the FQDN

First, find the region of your cluster and the resource group that holds its infrastructure. AKS places the public IP in a separate, automatically managed resource group (usually named MC_<resource-group>_<cluster-name>_<region>):

az aks show --resource-group <resource-group> --name <cluster-name> \
  --query "{region:location, nodeResourceGroup:nodeResourceGroup}" -o table

Then look up the FQDN on the public IP that matches the EXTERNAL-IP from Step 1:

az network public-ip list --resource-group <node-resource-group> \
  --query "[?ipAddress=='<external-ip>'].{ip:ipAddress, fqdn:dnsSettings.fqdn}" -o table

Example output:

Ip             Fqdn
  ---
20.51.102.233  contoso-virusscan.eastus.cloudapp.azure.com

You can also confirm with a DNS lookup from any machine:

nslookup <your-label>.<region>.cloudapp.azure.com

Step 5: Test the API through the FQDN

curl http://<your-label>.<region>.cloudapp.azure.com/virus/status

A successful response returns a JSON status document from the Virus Scan API. Use this FQDN as the base URL in your Cloudmersive SDK or API client configuration.

Using your own domain name (optional)

If you want to reach the API at a name under a domain you own, such as virusscan.contoso.com, create a CNAME record in your DNS provider that points to the Azure FQDN:

virusscan.contoso.com    CNAME    <your-label>.<region>.cloudapp.azure.com

Pointing a CNAME at the Azure FQDN is preferred over an A record pointing at the IP, because the IP can change if the Service is deleted and recreated. If you need a guaranteed-static IP, see the next section.

Reserving a static IP (optional)

By default, AKS allocates a dynamic public IP. It stays the same for the life of the Service, but is released if the Service is deleted. If you require an IP that survives Service deletion, create a static public IP with the DNS label already attached, and tell the Service to use it.

Create the static IP in the node resource group (from Step 4):

az network public-ip create \
  --resource-group <node-resource-group> \
  --name cloudmersive-virusscan-pip \
  --sku Standard \
  --allocation-method Static \
  --dns-name <your-label>

Point the Service at that IP by name:

kubectl annotate service cloudmersive-privatecloud-virusscanapi \
  service.beta.kubernetes.io/azure-pip-name=cloudmersive-virusscan-pip \
  --overwrite

Within a minute, kubectl get service cloudmersive-privatecloud-virusscanapi should show the new static IP as EXTERNAL-IP, and the FQDN from Step 4 resolves to it.

If you create the public IP in a resource group other than the node resource group, you must also add the annotation service.beta.kubernetes.io/azure-load-balancer-resource-group=<that-resource-group> and grant the AKS cluster identity the Network Contributor role on that resource group.

Changing or removing the label

To change the label, run the Step 3 command again with the new value. The --overwrite flag replaces the previous label.

To remove the annotation:

kubectl annotate service cloudmersive-privatecloud-virusscanapi \
  service.beta.kubernetes.io/azure-dns-label-name-

Notes

• Helm upgrades keep the annotation. The annotation is not part of the Helm chart, but Helm 3 leaves fields it does not manage in place during helm upgrade. You do not need to reapply it after upgrading.